{"level":"info","ts":"2026-11-04T00:16:35.384Z","logger":"kuadrant-operator","msg":"go version: go1.26.7 (Red Hat 1.26.7-1.el9_8) X:strictfipsruntime"}
{"level":"info","ts":"2026-11-04T00:16:35.384Z","logger":"kuadrant-operator","msg":"go os/arch: linux/amd64"}
{"level":"info","ts":"2026-11-04T00:16:35.384Z","logger":"kuadrant-operator","msg":"base logger","log level":"info","log mode":"production"}
{"level":"info","ts":"2026-11-04T00:16:35.384Z","logger":"kuadrant-operator","msg":"build information","version":"1.5.3","commit":"00b87406469a6b16adaa60f149ee6ce78afcd07d","dirty":"false"}
{"level":"info","ts":"2026-11-04T00:16:35.676Z","logger":"kuadrant-operator","msg":"envoygateway is not installed, skipping related watches and reconcilers"}
{"level":"info","ts":"2026-11-04T00:16:35.676Z","logger":"kuadrant-operator.extensions","msg":"Discovered extension","name":"oidc-policy","path":"/extensions/oidc-policy/oidc-policy"}
{"level":"info","ts":"2026-11-04T00:16:35.676Z","logger":"kuadrant-operator.extensions","msg":"Discovered extension","name":"plan-policy","path":"/extensions/plan-policy/plan-policy"}
{"level":"info","ts":"2026-11-04T00:16:35.676Z","logger":"kuadrant-operator.extensions","msg":"Discovered extension","name":"telemetry-policy","path":"/extensions/telemetry-policy/telemetry-policy"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authconfig watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"envoyfilter watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"limitador watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"developer portal deployment watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"extension manager"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"topology configmap watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"servicemonitor watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"dnspolicy watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"tlspolicy watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"peerauthentication watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"consoleplugin watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"httproute watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"grpcroute watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"gateway watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"clusterissuers watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"gatewayclass watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"cluster version watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"dnsrecord watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authorino watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"issuers watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"certificate watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authpolicy watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"tokenratelimitpolicy watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"limitador deployment watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"wasm server"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"kuadrant watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"ratelimitpolicy watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator","msg":"starting runnable","name":"podmonitor watcher"}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator.extensions.extension.oidc-policy","msg":"starting..."}
{"level":"info","ts":"2026-11-04T00:16:35.677Z","logger":"kuadrant-operator.extensions.extension.oidc-policy","msg":"removing socket file","socket":"/tmp/kuadrant/oidc-policy/.grpc.sock"}
{"level":"info","ts":"2026-11-04T00:16:35.678Z","logger":"kuadrant-operator.extensions.extension.oidc-policy","msg":"started"}
{"level":"info","ts":"2026-11-04T00:16:35.678Z","logger":"kuadrant-operator.extensions.extension.plan-policy","msg":"starting..."}
{"level":"info","ts":"2026-11-04T00:16:35.678Z","logger":"kuadrant-operator.extensions.extension.plan-policy","msg":"removing socket file","socket":"/tmp/kuadrant/plan-policy/.grpc.sock"}
{"level":"info","ts":"2026-11-04T00:16:35.678Z","logger":"kuadrant-operator.extensions.extension.plan-policy","msg":"started"}
{"level":"info","ts":"2026-11-04T00:16:35.678Z","logger":"kuadrant-operator.extensions.extension.telemetry-policy","msg":"starting..."}
{"level":"info","ts":"2026-11-04T00:16:35.678Z","logger":"kuadrant-operator.extensions.extension.telemetry-policy","msg":"removing socket file","socket":"/tmp/kuadrant/telemetry-policy/.grpc.sock"}
{"level":"info","ts":"2026-11-04T00:16:35.679Z","logger":"kuadrant-operator.extensions.extension.telemetry-policy","msg":"started"}
{"level":"info","ts":"2026-11-04T00:16:35.679Z","logger":"kuadrant-operator.extensions.extension","msg":"starting descriptor service","port":50051}
{"level":"info","ts":"2026-11-04T00:16:35.695Z","logger":"kuadrant-operator.WasmServer","msg":"starting wasm server (h2c)","port":8082,"file":"/wasm/plugin.wasm","sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}
{"level":"info","ts":"2026-11-04T00:16:35Z","logger":"plan-policy-extension-controller","msg":"Starting EventSource","controller":"plan-policy-extension-controller","source":"channel source: 0x151b79deba40"}
{"level":"info","ts":"2026-11-04T00:16:35Z","logger":"plan-policy-extension-controller","msg":"Starting EventSource","controller":"plan-policy-extension-controller","source":"kind source: *v1alpha1.PlanPolicy"}
{"level":"info","ts":"2026-11-04T00:16:35Z","logger":"plan-policy-extension-controller","msg":"Starting EventSource","controller":"plan-policy-extension-controller","source":"kind source: *v1.RateLimitPolicy"}
{"level":"info","ts":"2026-11-04T00:16:35Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"channel source: 0x20ddb1fb71f0"}
{"level":"info","ts":"2026-11-04T00:16:35Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"kind source: *v1alpha1.OIDCPolicy"}
{"level":"info","ts":"2026-11-04T00:16:35Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"kind source: *v1.AuthPolicy"}
{"level":"info","ts":"2026-11-04T00:16:35Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"kind source: *v1.HTTPRoute"}
{"level":"info","ts":"2026-11-04T00:16:35Z","logger":"telemetry-policy-extension-controller","msg":"Starting EventSource","controller":"telemetry-policy-extension-controller","source":"channel source: 0x3c43e85ba0e0"}
{"level":"info","ts":"2026-11-04T00:16:35Z","logger":"telemetry-policy-extension-controller","msg":"Starting EventSource","controller":"telemetry-policy-extension-controller","source":"kind source: *v1alpha1.TelemetryPolicy"}
{"level":"info","ts":"2026-11-04T00:16:35.778Z","logger":"kuadrant-operator.controller-runtime.metrics","msg":"Starting metrics server"}
{"level":"info","ts":"2026-11-04T00:16:35.778Z","logger":"kuadrant-operator","msg":"starting server","name":"health probe","addr":"[::]:8081"}
{"level":"info","ts":"2026-11-04T00:16:35.778Z","logger":"kuadrant-operator.controller-runtime.metrics","msg":"Serving metrics server","bindAddress":":8080","secure":false}
{"level":"info","ts":"2026-11-04T00:16:35.778Z","logger":"kuadrant-operator","msg":"attempting to acquire leader lease kuadrant-system/f139389e.kuadrant.io..."}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"Starting Controller","controller":"telemetry-policy-extension-controller"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"Starting workers","controller":"telemetry-policy-extension-controller","worker count":1}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w1-7966af","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-7966af","reconcileID":"ccaea225-6a19-4560-9146-17aa371edd9d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w1-7966af","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"plan-policy-extension-controller","msg":"Starting Controller","controller":"plan-policy-extension-controller"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"plan-policy-extension-controller","msg":"Starting workers","controller":"plan-policy-extension-controller","worker count":1}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-7966af","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"oidc-policy-controller","msg":"Starting Controller","controller":"oidc-policy-controller"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"oidc-policy-controller","msg":"Starting workers","controller":"oidc-policy-controller","worker count":1}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w2-58b06e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-58b06e","reconcileID":"8245b78d-6e42-4d69-9020-caa28ed829a7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w2-58b06e","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-58b06e","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:16:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-11ea30","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-11ea30","reconcileID":"c51c54ff-34cc-4b1e-8947-9dc4a7b0cc9d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w3-11ea30","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-11ea30","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-de0ea2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-de0ea2","reconcileID":"bcaa9fbd-8515-44ee-8950-496191ab212a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w4-de0ea2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-de0ea2","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:16:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry","reconcileID":"b9bef616-2bcf-4dfb-afe6-8e9d49bc9b6b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-1c8dd4","reconcileID":"d8154d38-b165-4c11-8cc9-2060b7114839","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-1c8dd4","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:16:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:16:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:16:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:16:39Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:16:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:16:51.874Z","logger":"kuadrant-operator","msg":"successfully acquired lease kuadrant-system/f139389e.kuadrant.io"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1beta3.AuthConfig"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.PodMonitor"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.TLSPolicy"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha1.Limitador"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.PeerAuthentication"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ConsolePlugin"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.HTTPRoute"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.GRPCRoute"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Gateway"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ClusterIssuer"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.GatewayClass"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ClusterVersion"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha1.DNSRecord"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1beta1.Authorino"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Issuer"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Certificate"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.AuthPolicy"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.DNSPolicy"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha1.TokenRateLimitPolicy"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.RateLimitPolicy"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1beta1.Kuadrant"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ConfigMap"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha3.EnvoyFilter"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ServiceMonitor"}
{"level":"info","ts":"2026-11-04T00:16:51.875Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-04T00:16:52.976Z","logger":"kuadrant-operator","msg":"Starting Controller","controller":"controller"}
{"level":"info","ts":"2026-11-04T00:16:52.976Z","logger":"kuadrant-operator","msg":"Starting workers","controller":"controller","worker count":1}
{"level":"info","ts":"2026-11-04T00:16:58.482Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","Limitador","HTTPRoute","Gateway","ConfigMap","EnvoyFilter","AuthPolicy","Deployment","ConsolePlugin","GatewayClass","ClusterVersion","Kuadrant","Authorino","Issuer"],"eventTypes":{"create":401}}
{"level":"info","ts":"2026-11-04T00:16:58.613Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:16:58.623Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:16:59.731Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:16:59.838Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:16:59.925Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:16:59.925Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:00.149Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:17:01.762Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:01.765Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:01.765Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:01.766Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:01.830Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:01.836Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:17:01.991Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:05.682Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:05.683Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:12.351Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Limitador","AuthPolicy","AuthConfig","HTTPRoute","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"create":30,"update":13}}
{"level":"info","ts":"2026-11-04T00:17:12.535Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:13.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:17:13.457Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:17:13.457Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:15.520Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:15.531Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:15.536Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:17:15.536Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:15.542Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:15.542Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:15.552Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:17.545Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:17.545Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:17:17.871Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-de0ea2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:17:18.233Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig"],"eventTypes":{"update":13}}
{"level":"error","ts":"2026-11-04T00:17:21.294Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-7966af-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-7966af-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:17:21.363Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w3-11ea30-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w3-11ea30-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:17:21.436Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:17:27.762Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","AuthPolicy","Gateway","Limitador","HTTPRoute"],"eventTypes":{"create":1,"update":20}}
{"level":"info","ts":"2026-11-04T00:17:27.895Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:28.928Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:17:29.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:17:29.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:31.052Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:31.053Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:31.059Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:17:31.113Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:31.115Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:31.115Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:31.211Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:33.410Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:33.410Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:40.452Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","ConfigMap","EnvoyFilter","HTTPRoute","Limitador"],"eventTypes":{"create":12,"update":19}}
{"level":"info","ts":"2026-11-04T00:17:40.796Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:41.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:17:41.915Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:17:41.915Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:44.123Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:44.128Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:17:44.128Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:44.134Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:44.134Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:44.123Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:44.149Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:46.124Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:46.124Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:17:46.509Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-1c8dd4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:17:55.668Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","Gateway","ConfigMap","Limitador","HTTPRoute"],"eventTypes":{"create":2,"delete":1,"update":18}}
{"level":"info","ts":"2026-11-04T00:17:56.061Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:56.826Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:17:56.929Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:17:56.929Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:58.966Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:58.970Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:58.970Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:17:59.028Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:17:59.036Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:17:59.044Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:17:59.159Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:18:01.839Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:18:02.222Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:02.222Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:02.987Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":1}}
{"level":"info","ts":"2026-11-04T00:18:05.859Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:18:05.864Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:05.864Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:05.913Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:05.918Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:18:05.929Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:18:05.978Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:18:05.978Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:18:06.027Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fd5e7217645340c85e10d8cb280c8ce1834b3e1e2087bd430aa1104f9ba98853","error":"authconfigs.authorino.kuadrant.io \"fd5e7217645340c85e10d8cb280c8ce1834b3e1e2087bd430aa1104f9ba98853\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.117Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/544c52bbb272eecbb0d1a780f7840e59fbce42eca3afbccd1fb1ff7b2777bba3","error":"authconfigs.authorino.kuadrant.io \"544c52bbb272eecbb0d1a780f7840e59fbce42eca3afbccd1fb1ff7b2777bba3\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.176Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a2244a765c839059fd8f4a1b1d5537022815c960ab6fa5b20c13b2d2d118dbf8","error":"authconfigs.authorino.kuadrant.io \"a2244a765c839059fd8f4a1b1d5537022815c960ab6fa5b20c13b2d2d118dbf8\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.231Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f709ed1e30b06fa9eae62c3cadca35b373bbc72d0d8178d703b83ed4c9a445c3","error":"authconfigs.authorino.kuadrant.io \"f709ed1e30b06fa9eae62c3cadca35b373bbc72d0d8178d703b83ed4c9a445c3\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.286Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/df3f52958fac28cb05f7f7e3e49a59d24a57ef81a7b3012089078c6064eb3c1b","error":"authconfigs.authorino.kuadrant.io \"df3f52958fac28cb05f7f7e3e49a59d24a57ef81a7b3012089078c6064eb3c1b\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.341Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2d008353cf8820a0131fb3bb173f8c33c9f68e00193b44b5e4e5cb07bfc7485d","error":"authconfigs.authorino.kuadrant.io \"2d008353cf8820a0131fb3bb173f8c33c9f68e00193b44b5e4e5cb07bfc7485d\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.395Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/53ee25fdfcad8d1f9e9b4a89265e76092acec4bab1c567d9b1a05d38edbca7b4","error":"authconfigs.authorino.kuadrant.io \"53ee25fdfcad8d1f9e9b4a89265e76092acec4bab1c567d9b1a05d38edbca7b4\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.551Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1834cef5b0c47c760661d36924337bf4487017a62b86104df4ce828338a1c197","error":"authconfigs.authorino.kuadrant.io \"1834cef5b0c47c760661d36924337bf4487017a62b86104df4ce828338a1c197\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.564Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-11ea30","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:27Z","generation":12,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5f9d701c-f599-44d0-846f-c2a7e5638d99\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:02Z"}],"name":"kuadrant-e2e-worker-w3-11ea30","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-11ea30","uid":"5f9d701c-f599-44d0-846f-c2a7e5638d99"}],"resourceVersion":"36691","uid":"d38a62c0-eb55-4f83-8e14-0f0bf8683fef"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"7e501414e2d808948b5eddaa7f3eb13b4877ce82957d2adebaf34a836c5ce444\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"fa4d09e98a2556f31180e48c4d9d80995168b68c25255a6617ff5fcec5af76d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0e265f41f92f25d7807dc08172a944eaac20288601372a86e930f1345946c867\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"8ac3a676eccce06c93a581175c31eefc5da410e70579309c902ab32597ac5f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"099db7f703bc18e91019eee55e14ea78311b9e8c006a6d80178b4427969bbe2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"d167486b3a286179f2a574734132194356fcf46fe317fbc094da630cd968b226\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"59ce02df7fa04b0cc60f0ea6f22aa086b0f51340de5d6c38e7697282ade95583\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"4bd8db4d8fde3b6527fddb55cfec241fb481828efbf9384f3e0afc5cf1134067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"290bb37a29b764a67d6d28298d3b239bc4fa201a3722b25741fd74ee359cbca8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9be45ffa797958c72a1a39203c0b588ed452ee5d9d252c5df9004f63ed498d07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ec7eda29a80355e79ad584ae112314a634ff966c3845c322adb4c7e30a115927\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"c946d75bac431574ecf87a5ba47e15caa560da872a09174b5036bf9f90c0ebd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"f7e700fd716c6572c297a61d035137c0a615240ceb902a6f605517e43cb3b51b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"024c8305fe118d0adf871619e5660208bb3382c0be529a41df5bf4c8b81e1a41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"02e591b14d1d911b248f6a57615920c164dc27ece5d75dc59e40f7c966017a86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"d6c7400827550730c2698f1fda6eab32d7ec1af6b7a019c1baa88a91919eae34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"48797135d73f587e843f75f61ae594882c62d94de2fad142f884d56b879787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"02778cc72718db248e0a19e01423d397465a06d51f9ccb69e6ebbfd24851cbf3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"5a8ec189257589d6eb2f8119a6e11a4ef922aa17b4e7f72784d8a4295931987b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"052c0658d6bef841b2dee7dfa4a1ac26c6104cb5e1b1b5ff1aa72d06ba0068aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5f33cfc21b53390e53f539550daf92821f9f9966396b0c1b8dffc81c79834ef3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"458fc67391ba189a51424b60a1833c6b3aac1b0d9a80b66bedc8a4bc0720cad4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e1263ac989787c1334fae799fad37ba5523a9c7fea8a3ced963e53e133ad05cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6634be4e1e349e075fa306fec4cc8d490cf8e09f34d63f6366662a1e5da80f59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"567cb1329c5ce873181f63aa9585b36cbdd31728ac0ff948e77b0038d7b0d639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0cc742b9a303446dd9839593bb0c73439ebe804c6983e77f44562d58f11d5bf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"a1b7750bd5e7b7007476ebb57ac4209b2603ef7fba2a1dfc6830a5e86f72b5ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"533f5e66529af854e63da092f4998096cda919d44d8f250f0bee8346a83b561c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"60dc4f43d30a83a433e7a7c8ec26760512fe3b6834045fed257f83519e1010b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"397ec11215416691c2d8065d6f12e30fb013ec47cb386ea293533603ce3c74d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ef2202f78c37e4bafa6be5121685839a838127cf98c583957df554688be0c13a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"61b462ba56beb0dd5c7a00db5ec898e65270993d6a30a37aa3f95c03740e42cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"6c33dffb6bfe6129da2f607bcaf300235c0c955b262eacfa84e45b66cbc52926\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"2831ae6371f9fcc08ab710fa949e52c2b1060e6692e034c9ac5336473e5e77c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c4e20feaa61d40b392e7c478b4878f1e369578fbfb2cdcbb2efa85fd0f42cb97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"7d11de4de428673bfe2ea958eeedb0f76eeeb719dbc4f94205024d3eb2d7a40d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e9bb7245f77cc45af3616db7e75d0905c9415f2cd7e6afb8e52b0903c5026fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"13f864bc48d9cb4c17311cc93c47e92f9e68f847b23fd1d989c1777bf12ecaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"ca4e394888dcdbbedd3071a78dacf7f7734b1637ce0022dd06d6c8d5db89a9d7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3889c79f942fd5cd87050886fa73bf885ce15f36f46450a0b06680e03f0945e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"b51976e87d63318dca70c311ac6aa5346c87110ea930c83c8a7e6be98276cb68\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c042198a65c10a236d44152eb94d1c9ce282012744b5881818ac1c789776cc86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"064cd97002a8adf3f73a1c219c01ede3a466154324bf9c2d38ed802996fa1c93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"24055b76dd1b2b1074b2af17164520546ebf3584547ebb08222e57176c469cec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"0814649228590707265c0c5f4c05481a24e467825eb04f2cfe9b050cec451475\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"101523cf77328d6cc8d89b725b6358b5399ccbf12d0f5579fea9b252c21ed884\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6d1abdeb903d5c7409da81b9494cfb02588fce8bc268ce067c72281f3d2a3423\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bd98fc62222edd4f185fb418cc21b343cd8fb7dadb018d20322923343b635a23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23582f77e306c43fbb9c186dd67dce35dbac27b48c88e55ce95f824242e5c070\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"4653b49e1df2d1ad70ac0cb086bd25a161a083daa5623830bf9c23a4d32d81d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d273924852db8aadf7dd4228e0f5a246820a4ddd31c0a3f987b9bee859fcb85f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0f5c60927f2e0fa483306b2cb5bf209e25b290919908f47c32ecfb3f2d4ea741\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"b9f85a204cf99a8911948f83837caa2637e403dd000a62a8fc8effcaed065b7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5d80974a71752b455cbe1cf7f6745663ec15276dc551e435604c507fc7e1f824\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"8ad362d32578f96da0402397f19717a43bb6b422cc88ff4f9f1fcd9f9f051ded\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"996699b8fde3fe7b82d7fee633be4828868331af28fd31564d51eafe4050a887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"b6cd3cb3d8fe6c97811a84bcefeb660f7df86ee280fdb597ead5f618d1f1ff9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"50366813a245c7608d0499fe96aa6bcb2aa44c936eaff981254612745a5997bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"3287a60b3c10d53d6c1dc921ce50cc0e03b5652bb4969c0f98a7844bcd398280\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"a94425a593076417c83b2a40f12a8ae3c5c6b662ea65b8547feb3da20c01a7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"33b8c81c912fc47e6e2de04cb9f5de615ad2f5719d8c77a44640d718076dd61b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5cb8b3de52308e835c6dba6ef21bbbd5cdcc08e3a265f908db28054feb938acd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9ba49527c258b531f2ee72b000f546a9ebfd260a661984e53298846f5ebcce92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"ab28c9d732dd6eb9a5c664acc03cf1b527de0c2428670674b22dbf4902b0d28e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"797ae6033407ba51a6da601a47eb6f0aee25cffacff63d84822e2ead6e27cc17\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e20a7320c56120af7dde4839033f5c4891aa05d7c9eac837d45775e251dd40bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"1cf89413c4e9b557bee9f2d1b259d19dd3bdd194fa97af466a817747d338f22c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bceae3e6581f689850ae06da68761e7a9701cc2befc42b5db23b5de587eaa948\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6820726e004d8eb5c0fdc5bf7ceb2e9f78a4c533b6cd4ca0e024f6f2969a5489\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"3740f1f42e103769f8eb7f75f85c2046536e7cd0ead852ec9eaacc5bb6b1828c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"92a48cb8cba483dd253a3593c7e275206a0068f8bf2edbe9cc778c48036b80eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"dba8d67f8dc748e736bddfde9787dcd9f2abc4734b33904c161dad62fd54eb51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23e5d03604f396cf0f7722326bd1ab80ece27d6aa17559855854e8ee3826a9df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"f69075aec72ac5316b8ba068397d9bdf8b100ff775c12f10dc7c4a33141e4e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"39dd8dd5a8484f7acdaf3dc3a0c56c3398c524eb4109939c214eb63699129f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"28bcc6325fdd4b99a4f30057dc26255507ed669f632fedbfe422e47bc4af05f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"816c0d35beb47f6d90c29c30bffa876aa137bb36f61871cfa8a2aec40877b53e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b5cc0bb9c7d9964759f7998f9585e1e621c82d9037273b378114680ff9987fd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d6fc562ce8225bbeaea0c1a8d900c397a0f6ffdd32d289781d766cd6717275e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"222e4bc4c432b58101d67be0f5d1761ac686be63bd1cd2368af1e6ccd4ab2af1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e76915430709bf5feb36050c9e422151d907c366bbb29f3971af1c955b350a6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3e69f6a0f05cf95e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"fa6dfe6a45bf0083d1bbba31cc4b6ae0995579a3592c3a4aee778ecd3ef10c7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-11ea30"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:06.606Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1eba2d7d2b8d61e671db29c715d50b8f605faf91c0e6cc8fe3b78c2ae0b08096","error":"authconfigs.authorino.kuadrant.io \"1eba2d7d2b8d61e671db29c715d50b8f605faf91c0e6cc8fe3b78c2ae0b08096\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.660Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4fd7b512aa85d92086f51152c16cbd4e4ecdbb62d0af97afd89ddc6db1f15ce3","error":"authconfigs.authorino.kuadrant.io \"4fd7b512aa85d92086f51152c16cbd4e4ecdbb62d0af97afd89ddc6db1f15ce3\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.764Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4890a9ea25546f5d740923d78252a2c5d10f8e9ba408e3db81a2442bfa6d51ed","error":"authconfigs.authorino.kuadrant.io \"4890a9ea25546f5d740923d78252a2c5d10f8e9ba408e3db81a2442bfa6d51ed\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.779Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7966af","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:11:32Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3339de9d-533d-4f55-91d0-b84170f6b978\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:02Z"}],"name":"kuadrant-e2e-worker-w1-7966af","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7966af","uid":"3339de9d-533d-4f55-91d0-b84170f6b978"}],"resourceVersion":"36723","uid":"84d3cf1b-9529-4eec-8e08-c57c140360fb"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"8f671fe7fb5f95b66e479125c8b19fd0217da23efe9684323c945741670436f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7944c68a19f214e073476795452b68fc9f5c529621681ea36203a49113e60ea4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"44a37e2c7d3d57249bc83945c3dceef1cc1b386a13ea420490c3c498650356fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"55f6b7654a8478c1590ad97fd880538c4663712c8b5f9f65f533de7758a22fa5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"6c0eea8cb78db6808b765b480760119a06ee79ae8167f8d90831e4cb281cb055\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"4b8eaf23f03d065c5b264b0666f537c2a1f3ae7fc4800d616579730b9f10453e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"fee03f39e20b1fa1cbdef880cfa00e34a91c55cca98dd062d1232a8c504a2a8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"a922303cec22f7f675536511ea62683fd98789b99e59a1c67809c786530aae41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"53857e7b46c67135c4eea145b67cf842f3113bae4858e449b4d0bd56eef71c2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3ae896f044fa430bcc80634f8b4159dd74a9f5a95c90c59479a5dd22d0c0a777\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2cb7e6e19fbc4c9c857a59ce3a675c11eef097c10a58fd1655b73542355afa67\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"78ffc0a3105eab5a7fae567e63533e82ce53434ea80bc50692e1945291378838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"b9aad3b0a062c993c24c9d12afd48a040a60b2da90cb386f3c22af54c8c885b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"1dc52073af256dbc9bb4be8aaa767206edbfe0aa08db683e79d9c67836f18746\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c08b916a799c7312d7c549cad9123478e41f46f5b311664828e815118232009c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"9ca70c30491e45dd972040fc2132bc2d62a625825b60a0518f18455130575695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"0ba6095ced0c22c4974527bf1601e91ad26fdb9633a969255b40ac3b151b5e7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"c0b083ec2fc1a3ab9adcf766f5aee6a66960961c41c3c63836a6336fa945104f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"ba4fd17bdedfb57a0c3441c67ea8be06324527464c0ca54e0f7b1e020f9608c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"93832e579686254e6647bbe99864abdbe5a67d9fa759934ac94312f21c416252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"34d332f1eb88b2af92c85c8d2543b4528b4c50eda75d3fb6aee69daef2c453c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"66d98bd56e776500d44f45a0859b97d4562983d2260958e379ea35e9487ad4eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7d5b6ecac99a81903af1f07695f086c4bfd109bafab8f8194ad4b4fd091b34aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"b2b4d2e55bb399b589ee7e5e2cb4a7f725f020a25a59dc6455aaa53dd45398d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"7d652c0a553e29fb216d2deea09e5c3346e0879578a2d9458153f518172aeb13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c9017f020a8779df1bf1a4aa893cc309f09fc238e8d01959aa19111eb0b5ed65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c6b72d0a40389b38ea00360fdbcf1fb88e393c234225ed00a5a7c17770d9effe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"273f3c97f0d3804192fc0e01200c142ec51c874dee497a0c443d8b979e048ebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"3c2eed2c4076ab0ac01618527715b342fa5ecc8d9baa7c79f1feeb964c3799f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"6849f90c55719b2024e77469af36a9418435813fdba53de85548fc45c8041b2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4b68355e16dffced958b3c6cf6a85ace82156bf11ac5213f8a94b85b21483dd9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6e4d91976aaaeb7700bda58ca9f7d4fc8747fc30b47ad671e61c49301d3138c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e4f4c91d80ecb2b9c5e16dc7f16c85265f9b25ba1cdedb41f12bda22dd9a979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0ed28d60417f2be6fd8d8ca4e4f44017f1958dcb5f04c4b83faf3bc6eeab4d6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f475baaea88901f678e1e61313882f0906b83362598efaba02eeb7786e00c4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"bdebda30124b2b8564734f643be613c091aa384bca2e55611ab88e7cd4cd1e3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a31f206ab8dbca0afdfa573363aaccf106a7f54a5ec5ca868f0491263074ecb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"251af245b620a7fa0dd508c8b95ff9e02509b8bbe434073cf9b83ed0bf227633\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"413bdc5e3c8df93edf127de1f068c54db611a5add63e857a73c37db5c6778c81\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2dde942f6b0efa7d7693b097e74d457342dde9cd9f03e35cf7d39070c096b740\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"860dc65fe8df4fdb17f386090ff27961bc6e43ace3152d5a0c9832e5477eef9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3f40a08f9e67e8dea27e0ac184897b50a4a576eb35780ee92df8400cfcf89d70\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"19f5445fe08773500d55b3e72f93509c2849e7e895c1622c020ddc87da19fffe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"400cdf544c87d2cdde4a5d3684f85f830b61d03ef5e1b02d0be1783c7c45c882\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f540b85497841fd97f6f21f83df47eb33faf6a12440f4d57614189d4bc7e3f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"36893b95343f134093b02742f36ecfccd053fee778fdc4f679be27f0821f963c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ba6e1647cd84f03625de8a02d65d855c5b7014eccd9876502769172d848baf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"90d439ca579d037200d4b9b1351688c85e60d2b62c325dcd4c864dbca1f9aad0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0c780dabd6df0d31a9112fdc030e2d5ab45c634fa34c405e7c67193ba45c772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2b0c90ffa9c94815d4d916e763f757d711b83e43dc08707df89db7d8d8406388\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"22d7d611d13f7efc7d2839b9a4d644f15fce375261b2ef9f4c6f4a7c127c986a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"078831a5d217c20da318ae12d6aa231e9bbff23ac0abcd2591db8af03a0f020e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25b24056e5f00ce11ef07850b2b553069f88dfd09550c0f5ef9bd3abd7e8698a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"b093acc088f5b3c6abf3efd2b7e49c62fb4973951ca4bcb2de60b577d838bb0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce534ddc012dd199020559b4cd72e77478d843282db2cc920f6188c0ac48b895\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"fa2a9ebdd28b4100f82ad9bdbf5df9c5aa1c538e9c152619e7c88e18c7d108ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8dba5b80a8bbf465d2b8b22eaabcf3c0bd9ec9943de0ee152b6ff7246eec108\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"2213becdc51c61f7f2e2b6864f2180180274ae136569ddccfa233df684854720\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a2d41d1bfe2845a09f9c006079e27f8bda38d62da8cf25fd8a189dcff49f66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8b5df53b7e5c7e22beb55f83245651dce6a8917bcdf2dd35bc44cc2e3e651fdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbdcc0f989595829fe92a8e9a32d69ea8a40d9b8cf10776562925da6cc33aeb2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7373120acb8fd2eb2c4957816e801ab94992057655f4e91e779b8aba2001382a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa6b3088cedb629d50bd69ee631bdffecde5a774bb58b1674ffbb601ff8cd135\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4e5201a1a8ee2abf1581a722b9b2764742922db1f0ff711794e338b7f65d0371\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda9555e5eb3a15f39830032fce44310c889ff832fd0ad45064af7e4bf34363\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"ef25a425e1d6dfe3f23ef10f30a834fe7f3b5ec9eeab376d9f7fedbf161693a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"715838e358b45a42fdfab1383d224600a95382ec941889a2a8cbf028b75f2333\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"f1d83a408601470954b72d92543728a94b837de1f26ba9bcea2689e096a9d18c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486256a75c498ab148cc9bb46bcea251297e2b74e1cf34bad3c55c74a14573c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"99754b4eef34970705761ee0d474fac3c0af931cfc8eeec218184e704566664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b402fefc886c9554b97ff3213c74deae584634017111f44bdedcad110954f5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"cf8a0e7503866d654dd35b207f84dd9afb7d006187b956dd25ac362a1582e4c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdbee3a9bd7f4b5ab291b0c7d51f26f71e9fde499c7da46ea9b0e5cd6486764d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"289d88ae80ca96598acfdb993945a9a7bc9728d40a7752db7cd5dfcc4255cf87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c01a1bbd47226264fe8f94e0d3575ca0ff85f4d02cb4b4ce6550ff37288daa4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"beb7bad3db035dde2975e132668d9e271e70d2a74fb9bf4ea61939150d443fbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75b7df72e9c7be8b9431666359ab3de5e8df05448b1f4b0276e5456fbcbb30a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"6ae83b4faccc867bb2b6cd562e04a27a61b810d3207c407f63565cd861a705c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5516d78005de2cfe8956e3ba1e8ec342a541cc4002706d987fcd519d0b67cf71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"dfaf750c9abe122c321117f70e65b282b6e2c59110bb0232a53f861824281705\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4556062116dd6b1b9e44244b886671cebc576038b0f9c1c1fe3e13deefafa523\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"5c9517da623973c54b0e61ed81b97b5019e20a39cee4222e9c2001fdb37f61c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa04b5c8a50845ad82f4ea9bd5f1f7c759ce4450149519bb00523b008482cb75\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6052d33df74209b62973bde64ad856897511f6c7fa48511e4a12fdc24287a50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad466fcf1c5c4d7345f6eb4fa5808cff0469e236def3863eb4783f677353d152\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"effd523d3498f1d53a6191e49c89ec1a161c7bcacb667779c6d8003047645c13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e8588abbd835e92bd8170bc89597b0d56f24271385f73e5fad17ec99a7389718\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"f4b7585e2b62ac0a7dbb3a671941f9be5fe33ba4c89700d7d3d938c179517ab4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08d9d2aa5fadedf5c6dfbc45eb4f9c34ea2a1882947995b5c79a92c618dd8d69\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"182222bc7dc75bc923b9c50cb3480521ab543e3d3f58674f35fa711b4a4fa69b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"061c7e4d1b1d8866722f6c06899571bde9ea56d77ea14ff59cf1d915e2d9b1c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"d755fedb11567ddbb0eb17e40e71678bcdffb7ce224b77d1c35bce75b6f556e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de657ac3c36b9a560af065f79a5ee929b70dec023b7155afc6b66e41a52fb273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"43f437f56d846d068e2783e265d65343acc185d8e9b1b43de9a84d4b8a4bcf25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c39303e83fe285ea577e6e31ef4627d8e9c1575ce9cbf3c5585da04dc9c3146b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c03721f568137f1d8835419637c079a8fab9caa0309f3e0567b19d99133eac2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7eedcaf178c841ed379be213f3f34665f16bbe619f0fe9ef35d71b19c579b94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"aa1b2e83bb519ec79fcb87c4512f8421b5031a1f66602c9fef9caa19a2fecc9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6be017c8c4a655f626b1a60defee892156238e99009d2e530b9cb9de189201a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0f30b14be9585141d957a722c9bee91c27f7cf218fba3d4916cd634fa6b8c5f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e43cec109a35717b74a3a54ae0f1006635a20b91c9de1e75a82c32f0339b4ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"0eb8bee651ce7b42a148f283b008ad1b9eab9530a3234bdeaa371aa9074c6141\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f17d178977a829b7cb25e144281dd8bc17cfea4201e8f9d6e4abd729b51db1b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"15b69076679c9ee18f60045fa3138d011c2d117b2656f00acad6ea10179f5206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ccb310d1f482e6b78361f68b84c67bc46f7ad1c23eca07e13b5c6a27a096cf5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3006c2eb1cf0340b97d9cf4bdbdd7cea90026fcaf2fdfc3dd08c8e58ceae1938\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3eb001e52c79b1aa88f706bcbfda6899dd3d8312d2217dbb4f6b058a4602615\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"993295647de89316ed5016fc8beea92b6a66a8b34e5282043de690d88ac6d739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaae91b1f31dbd6654a5fd3c753d7ab2f9a54c9a352837dfd278c60a0fd25213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"411aef1a70bd99e949e340f4bff5dec9eb942d0e06e7075a78d572b412b7a939\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c928bea546bc63b3b8bd5d85d7a8f44207359e9772db70e9d65e9a38a136764\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8be814115fb7da807809a189087e4e033d326542da651f00ae28c8f14a5a6838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b458934204e7bd220bde8b2123b49c7fa677b901b7dc883fd85cbd8bef09f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"16517301869349c194fdc9624b1d4ecbd0be903f42b8c985af97867cf0023016\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ef3137adb71b08c83f1177afdfd70e3ceb53eb40eee682f1eb18aad1359fc66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8c7fce071dce1e65b18501c98e406d87231372ae5a9f5e8c347b65788df91aff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b13167a0b9b904765e5c7590d0ff54a0d4055061140144c50ac8d78e7f149e30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8e181d00f8b265fa8906db42847f65f424eec53caedb83469692e55f37e669d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a4b7d2121c1a0b6ea0d6f91f0b6dfca2759729cfe994a2eb6a6667e6b4edd0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6713bc99135c617edeeaade68698ecdf33d333131a77de2650c51b3b2fb36ef9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5eb305150bdafd8cd17ff8f66d77a2997545fb016d4fc2403dd456d505ca0b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"01277e6b7cec6e52c5ed8c8a780cb7fa31f56958fa93a2a5627034febf8791e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec9fcf7e18d4cac0d461636f2eca5067beeaa5440b72ee39b4f1cde5931fe481\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"41c187b864990629cecc9d75d09c283380fe5f99f4b35a1ec1a6932fb112a785\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9d90b0ca5be53b16d790c3082127cc7315e4666ae929559754734de0429c8be\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"91e27788a38a2bde\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"4b58c3803487d40cd3d7d9dc63790243a7353b4a1f8b9fd9ae2c009fc55d5d8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"26e65caa35770dcea82c3bc46eb21156e68b0f237e536d0654e8b461fea79765\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"443894938bd03a0c0dfb1a13d4e30954bc3b4aef05764e52dc4647fddd6751e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a8bde041ff87e0d7ca43c9b2cb552d0278f317b6db01967ac7e2b21386b4bd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c1e45b5496eca64cf0b773c04ff151ed5a4c0fb5e66b08193d6941fdb5aeadbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1945604402dab22a2bb92e179c6db3181c9764e9e4b91fc7ed2f36d11c05b72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"d2cbb037fb718698317e136295b45ed06d5851b3e4dd7b69cc5d4284cfa0e31b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7966af"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:06.819Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9636beef430a0213024a0501a2059fd9dad492e942d140612ed40c4989cc7d11","error":"authconfigs.authorino.kuadrant.io \"9636beef430a0213024a0501a2059fd9dad492e942d140612ed40c4989cc7d11\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.873Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3992bac39b8d1a57c8582a999ac57a48dba293fe5689869b4ffa0fb20eead7bf","error":"authconfigs.authorino.kuadrant.io \"3992bac39b8d1a57c8582a999ac57a48dba293fe5689869b4ffa0fb20eead7bf\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.928Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/93b512570350d711b84ab6891805c76ee10835b218468b693c0b1bd961cb52a7","error":"authconfigs.authorino.kuadrant.io \"93b512570350d711b84ab6891805c76ee10835b218468b693c0b1bd961cb52a7\" not found"}
{"level":"error","ts":"2026-11-04T00:18:06.982Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ad8611e714297628d173931a025f914ac9391a9f173a41bd86053e1f71a63478","error":"authconfigs.authorino.kuadrant.io \"ad8611e714297628d173931a025f914ac9391a9f173a41bd86053e1f71a63478\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.030Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-1c8dd4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:55Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"1022736a-9ea6-46d7-9666-09e1fa7f216f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:16:18Z"}],"name":"kuadrant-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-1c8dd4","uid":"1022736a-9ea6-46d7-9666-09e1fa7f216f"}],"resourceVersion":"35509","uid":"c24c7f5a-e883-441b-9157-1c12216ad398"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d722f2773a064322e4f94bdd5518f8f21a17a4d3e9be728f24cfb4fd345e4e9a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"fe2d1bb96a8aaf1ce9dcb9486703a202aee72f3d53ae431bd7231723e5bd74fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"872c935eb7627fa9e9b54e9b64feca8fcf4db2fc6263c2ad9182de3020414f41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c16aef0a553732620ab3d17553727fd98cffa1f02446927a150f00d70e52c05a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"18618e03f7ceb171bbfc4325ef3055eae56f1ab466480d27270950382def7ee6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7e18ce43d7153957576261ea6bd1838cbd27e9221d7441a51d3b82467e783035\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"deaeb61d09ab93f9f03227f87c16291cbf69018e9b985f45af50fd6bac96a4f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"498e7720200a468d4042e9bd9edeeb8ffed0aad4fe195cb3de0aaa2e7b1f7aa9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7a86223ba61568a2770448435689d6367383b116887b4e0f962f92d21f0d767b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"8ebb2e74c2ea0f835197bd8ac2f8e5e6aef50a2f05b7cab55e49ad3d0430e3ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"06e7cf7c58cdf904f2014d394fc10aae12621f7f0d3ebe5dd26256424fc624be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2e73311a2a5aabc79b44092dbee50596338ae09ffb74ee1ec20dbf97865ad4a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"a2c40926c96848a1f64e2f8432e7be0de6c63c281170eedd68453cf218b53470\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"eb903fb2f395cd1e0cd0ece3e9569e47debc23b27198f10c2c299239c6fbc66e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c54fca81c42e570a25905b3c6c7d0a776654133d335a9e76b5c542fdd08244f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"88bfc8c650c883186ac394d93461aaf7a113b8086749088f88121f96d71bc350\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"107c4fd088c79ed8fec71659768d87991ca27c12f0933f5856b0da18ddfa028e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"56d39e4652a0a101893e398463abb10dc9823cfd47192cabdd002e4ee6f525d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f6f7631a002f287686d1a42dfe6abf8ac2d9bbb36ba7b84b485fd82541e3675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7ab78aa758093de3cb3dfc32bc45f25e16886a2fc5e1820b9d810fcd1d1bb21a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b46d7a290c8c6c1a20e45d9a689facdaf1135fae0cc244ef0623792814525c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"d30fac8f2fb796899bcd15432be29e9913ef74cc833b8fa9172fcb3032a894b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08334bcfff931cd495c365f3735e3de949e766138a9b03ce39abc75f5f665541\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2987e31c5c3334f42edfdccb340b13f64ecb2e327c821bfe532cd3a9731cc0de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1eac59fc45114f2ce4deec1fdcf1c3fe2eb41f7adeda4c7ae7cfdc04fc65426\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"fa203dbd971b487b7333113774122af19d7dde397f3d8844cd2147b55778de4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1572ae59c6a795c338fb2bb2c6841973fa92ed1105168214da68a898a643cb43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"b9e1423918d69a0383c5a37f7b69c123793f9166183f73b9559bb7b0265193f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddca80e7dce3248bcb6173da3eae450a269cc516f706eef1eba2ea35c4a2688e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"abb79379262035a146f66aac08b02cff323165a37bacd7829b856522aca43887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c93ae5417465b5195f2f67ba8d1b25b4900246774df9fe2f5df40220efbfcc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"067c2408bbf439d968882014e393801f8ee59b42a180a1e2f88edc16f1c380dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7462618ce57719ee474fcda0c0f2b0a69b4be5f4fe22fb5a71662eace7c04552\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"610d27fbf7e70d25ca269c5f549054a67d35af30b7dd4fc784312db9cce4df23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e868ca29b1c1c2374441d92e4aaa1c6171e27635e90525412ba8c4bca24b59a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"585e58644bf42565979749c76320b49179d7aaafbcea3a586381c94c8ae91af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7a4155a07f6048125b423c1b6d272d77ea9bc24d7c897587107eb429ab2ab7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2ce83896170df3c28b859812d6e5a676644dc9aa0c347553cf19f4acaa03543e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07613ec6104cadec59fd785bcb990b5a38ea5343d6c74a38a40fad81b771b119\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"3dcf1f4a73977a1dad8f77938e6cb8b3e54b2d46359776c5af2e11edfab95c49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf1e7d0ef8559d974a1323420a3d396a5f1224745470bf01e5f84f9e90671cc6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7770ced6938234629c72124c64149fa0906e6875d3620e7f2a0b2b905a384722\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af5e6bdb6b32a2da886759932798d61fc00c2948cb89ef707a8c77de30dfbfc9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"27878634d95404360b653257f3b03d7fb2006ecd6ce2978b68a1d115150e59fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ccf4f502d8f42eaace6b37e237896d6658342da096b8598da2567e1a97cd7a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"f53d7752e5e8872a28aaf4951c5bb99e52039e2d080871c4e28011c2328f2109\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0442670ca837fcdf5b5b65185966e09a927dc7aa7c0ef0689658297531f91c7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"55f4c111860bc29246c5f77e3c4e7d48647a53865883b40ae1e8515b9d02d7e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"496e1bf7f5641b54d2165111905fa143e0caac6fab14aa60c4c4ba36d8450772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c345c923befde091471bab05f155033e00973c1f4322f2d695969ef630cdaa8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"667d3a93329c566724f271b9c13e60b7d3bdba5a17c57765887854900434892b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"1826d28a53942692d22546698b1e127e9f6cf018551f0976553bfa20e5361993\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb8bac264d82224c8d8c821d533af6243655e8d48c8764ba43c2d9a52e624ff8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c1b45264e1ceea9ba7c7c57d22e4cee07e3c66a3f40f55a0fb2a02229878d689\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2319eed8b4ef51b4414ccdc8857bd036554e70a55cfe750dc216906486952a53\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2eb301e5e4984be512b687e16a81a3a6a6ff2d80d4a23d38db2a15f8d2c5e23d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8542b97537c28e07d57bd0a9c9474f31b46be9996c4e9bfc3475585960e95017\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7af45dbed1145cbefae25036f9b976a4ba04ff1bd6d65257c779e505c08e7664\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206405c4fb067243fdbd7964f80dd6bb48a9e3ce2c5335c82aca73c228e43441\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cae718fdd03b8a36914e865ce59f9f9820ec9eef12d4d0c9c6228b86a7fca262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"88058e8c9de15d7da1fea7024cba67237bdea366968f5e13ad3e9c0be8b34c46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"d78e0b7b2fff91bae4004dc0f09025510ecd9eb4f6ceef5f1004705995ee6e82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2028771388f8279a0773be1740d35e06fd4143c31788bceed01bae9e8689e4e8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cb1bb94e9eb8722108b82378027c9a6cc6927392f2679669c7127da5b93d7f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45b69d0a2617fdc908edabde94957a37df9bab4d7c8d1f0da2d3348571dfe24a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"58271f39ba379295948cabb3698a9f3eb43a28dfe7bfe008e8ed6a9586432164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8a5f0bed0ea44e46c7ffd9439a1c95a25744aaa30796c29dedf2f67e0718e99\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3588a32f4036d13fb6b19114219c46cf512773bda9a64cb8254668ce2f84bbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67f92abfa1830b39b11b6fba47fa111e608ce1ecaf6453884763534c3d3fb793\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d43defb9cd59af289b9dfd9879f86908b2485fde88b5f2ad80ad79a573e5025c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a38a3aae7b31ec5ea9420576df60ef9fc1ea0e252b9d3d96184215ce79b3226\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"de97507b575cf8eeb6ed5f8969e3e733c20f8d71018e39890aa1f57e803f4cf2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-1c8dd4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:07.037Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/535b601410ede0247f13b22071a600e0462b97c69d3944f849f51fe28c5c074c","error":"authconfigs.authorino.kuadrant.io \"535b601410ede0247f13b22071a600e0462b97c69d3944f849f51fe28c5c074c\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.091Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c0fc48c217804298f7065cf7814c206265c7b6033a46499db6812c875bc3c7b5","error":"authconfigs.authorino.kuadrant.io \"c0fc48c217804298f7065cf7814c206265c7b6033a46499db6812c875bc3c7b5\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.146Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/674f9ddd5af785a1642daa64739186f2dbd32f50378263113aeb820f37e4b4c2","error":"authconfigs.authorino.kuadrant.io \"674f9ddd5af785a1642daa64739186f2dbd32f50378263113aeb820f37e4b4c2\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.200Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/522d819970b311e2cea6ce9616da3cbc543091693951fd280d491abf43a0d303","error":"authconfigs.authorino.kuadrant.io \"522d819970b311e2cea6ce9616da3cbc543091693951fd280d491abf43a0d303\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.254Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/efd1bb3b75beb3a10e033a94b58252f3a6d8869d8cfa7593e5ab757d11c6ec65","error":"authconfigs.authorino.kuadrant.io \"efd1bb3b75beb3a10e033a94b58252f3a6d8869d8cfa7593e5ab757d11c6ec65\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.309Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/59bef3101744f854a233fc8b5ca21d2bb9243fbd1a53b6d722a74273e71e15bf","error":"authconfigs.authorino.kuadrant.io \"59bef3101744f854a233fc8b5ca21d2bb9243fbd1a53b6d722a74273e71e15bf\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.364Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/03cf907efa376770577ec8d9dc1c16ffda80415c4145b9ed03ebef881bdb244f","error":"authconfigs.authorino.kuadrant.io \"03cf907efa376770577ec8d9dc1c16ffda80415c4145b9ed03ebef881bdb244f\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.418Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2e42eba28a89271531706ec1c47fe95011c7b4a6f07982921f9f1deb0e763d50","error":"authconfigs.authorino.kuadrant.io \"2e42eba28a89271531706ec1c47fe95011c7b4a6f07982921f9f1deb0e763d50\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.472Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/36ac8830e377e41de2240c6182d0235d616bff3e3db651e3f8ecdbb7cb1f4c81","error":"authconfigs.authorino.kuadrant.io \"36ac8830e377e41de2240c6182d0235d616bff3e3db651e3f8ecdbb7cb1f4c81\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.532Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:07.661Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:07.720Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:07.777Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"ea902c5b-884f-495e-92f4-34c6a10a144a","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w3-11ea30\" not found"}
{"level":"error","ts":"2026-11-04T00:18:07.835Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.017Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.076Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-eq-c29cf4","namespace":"llm","uid":"e3cb96ff-d27c-42a3-b43d-f484aabda347","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-eq-c29cf4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.135Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.257Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.316Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.377Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.497Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.616Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-sw-d71261","namespace":"llm","uid":"ab860901-e5c3-4d5a-959b-20a193caf018","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-sw-d71261\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.675Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:18:08.733Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:18:08.733Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:08.734Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:18:08.836Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w3-11ea30-kserve-route","namespace":"e2e-models-e2e-worker-w3-11ea30","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w3-11ea30-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:18:15.537Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Limitador","ConfigMap","HTTPRoute","AuthConfig"],"eventTypes":{"delete":25,"update":20}}
{"level":"info","ts":"2026-11-04T00:18:15.776Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:16.632Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:18:16.856Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:18:16.856Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:18.533Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:18:18.546Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:18.552Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:18:18.560Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:18.560Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:18.613Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:18:18.614Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:18:18.614Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:21.166Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:21.166Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:27.529Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Limitador","ConfigMap","HTTPRoute"],"eventTypes":{"create":2,"update":7}}
{"level":"info","ts":"2026-11-04T00:18:27.817Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:28.540Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:18:28.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:18:28.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:30.424Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:18:30.444Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:30.449Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:30.449Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:30.452Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:18:30.514Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:18:30.570Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:18:32.238Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:18:32.853Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:32.853Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:39.226Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","EnvoyFilter","TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-11-04T00:18:39.471Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:40.427Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:18:40.536Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:18:40.536Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:42.779Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:18:42.782Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:42.782Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:42.790Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:18:42.813Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:42.833Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:18:42.833Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:18:45.556Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:45.556Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:18:45.823Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-de0ea2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:18:55.278Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","HTTPRoute","ConfigMap","Gateway","Limitador"],"eventTypes":{"create":3,"delete":2,"update":19}}
{"level":"info","ts":"2026-11-04T00:18:55.569Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:18:57.368Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:18:57.484Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:18:57.484Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:00.348Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:19:00.351Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:00.351Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:00.351Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:00.357Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:19:00.359Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:19:00.509Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:19:03.377Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"fbe58237-7261-41f1-ac9d-8d7ea90d5267","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w3-11ea30\" not found"}
{"level":"error","ts":"2026-11-04T00:19:03.708Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:19:04.198Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:04.198Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:05.717Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-04T00:19:08.843Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:08.848Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:19:08.849Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:08.849Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:19:08.928Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:19:08.928Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:19:09.550Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-1c8dd4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:55Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"1022736a-9ea6-46d7-9666-09e1fa7f216f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:18:00Z"}],"name":"kuadrant-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-1c8dd4","uid":"1022736a-9ea6-46d7-9666-09e1fa7f216f"}],"resourceVersion":"38091","uid":"c24c7f5a-e883-441b-9157-1c12216ad398"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d722f2773a064322e4f94bdd5518f8f21a17a4d3e9be728f24cfb4fd345e4e9a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"fe2d1bb96a8aaf1ce9dcb9486703a202aee72f3d53ae431bd7231723e5bd74fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"98975d104850538a792ccd19e2cc94afc3ee0ae0c91994978b98ef785cbde53d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"872c935eb7627fa9e9b54e9b64feca8fcf4db2fc6263c2ad9182de3020414f41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c16aef0a553732620ab3d17553727fd98cffa1f02446927a150f00d70e52c05a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"8a830d301ff5a71a133f2e5920a029e3ec3236b99ca7c335ce75edb2f135cd0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"18618e03f7ceb171bbfc4325ef3055eae56f1ab466480d27270950382def7ee6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7e18ce43d7153957576261ea6bd1838cbd27e9221d7441a51d3b82467e783035\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"72ff7a0549b7f2b4006712493670cf5bcb7f7c53bc5317086464e575e8708f51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"deaeb61d09ab93f9f03227f87c16291cbf69018e9b985f45af50fd6bac96a4f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"498e7720200a468d4042e9bd9edeeb8ffed0aad4fe195cb3de0aaa2e7b1f7aa9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5557f0c59061b9b2fd5291c9ae974f8090764d56f8782ad1be7d9aa685dd069c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7a86223ba61568a2770448435689d6367383b116887b4e0f962f92d21f0d767b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"8ebb2e74c2ea0f835197bd8ac2f8e5e6aef50a2f05b7cab55e49ad3d0430e3ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"40baba532e9d879d798fe30bfe9c0d11138364343b9474190f8aad3b7b1f6915\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"06e7cf7c58cdf904f2014d394fc10aae12621f7f0d3ebe5dd26256424fc624be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2e73311a2a5aabc79b44092dbee50596338ae09ffb74ee1ec20dbf97865ad4a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"a2c40926c96848a1f64e2f8432e7be0de6c63c281170eedd68453cf218b53470\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"eb903fb2f395cd1e0cd0ece3e9569e47debc23b27198f10c2c299239c6fbc66e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f43c5685eb05b429ea9501f8435e99a510dded670763fd887490394976e47203\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"2f7853168e97bf4316ce3f174e5e8f601ff9b2184251eb8a5ff8c571e9117ad6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c54fca81c42e570a25905b3c6c7d0a776654133d335a9e76b5c542fdd08244f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"88bfc8c650c883186ac394d93461aaf7a113b8086749088f88121f96d71bc350\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"b4c9c4ef3b7ed99d874118d7d71fab084fd2693839924bcb9390472e1aa57efb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"107c4fd088c79ed8fec71659768d87991ca27c12f0933f5856b0da18ddfa028e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"56d39e4652a0a101893e398463abb10dc9823cfd47192cabdd002e4ee6f525d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f6f7631a002f287686d1a42dfe6abf8ac2d9bbb36ba7b84b485fd82541e3675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7ab78aa758093de3cb3dfc32bc45f25e16886a2fc5e1820b9d810fcd1d1bb21a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd316c1011be2ba1e92977697277c74807ad2d7d8863195c9ce94350cab7ff36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fac652fd9b1dc98ff92020b3cf0cdf4d301a3c4bc17712267db67f99723e5918\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b46d7a290c8c6c1a20e45d9a689facdaf1135fae0cc244ef0623792814525c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"d30fac8f2fb796899bcd15432be29e9913ef74cc833b8fa9172fcb3032a894b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08334bcfff931cd495c365f3735e3de949e766138a9b03ce39abc75f5f665541\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2987e31c5c3334f42edfdccb340b13f64ecb2e327c821bfe532cd3a9731cc0de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdd5f218bb1de67fdb4c5509a7e18511041e8821a02fa2e3f9adebc6b4874aa7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"4461e5dfd48fdc8eb0f2fa58b1fb467a8842997144340c53ec30b456d0c32819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1eac59fc45114f2ce4deec1fdcf1c3fe2eb41f7adeda4c7ae7cfdc04fc65426\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"fa203dbd971b487b7333113774122af19d7dde397f3d8844cd2147b55778de4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1572ae59c6a795c338fb2bb2c6841973fa92ed1105168214da68a898a643cb43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"b9e1423918d69a0383c5a37f7b69c123793f9166183f73b9559bb7b0265193f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddca80e7dce3248bcb6173da3eae450a269cc516f706eef1eba2ea35c4a2688e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"abb79379262035a146f66aac08b02cff323165a37bacd7829b856522aca43887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaa1b2a1054fb53c8ff038dac01c6267251d8afd3e74e84cdc91d24302a4e4de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"88690102e83c0534cc670fe54962275c7b96e72ac65fdc7d75bd0787be36cd80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c93ae5417465b5195f2f67ba8d1b25b4900246774df9fe2f5df40220efbfcc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"067c2408bbf439d968882014e393801f8ee59b42a180a1e2f88edc16f1c380dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bea74a5e79312d86a7437b9b9107c9aa5f686e6d9a4148db2aa2d554135a8305\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f77376be4767c7f0d7b4cb876abc7c786544b05ffbf59e71c40ed738c0f23c8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7462618ce57719ee474fcda0c0f2b0a69b4be5f4fe22fb5a71662eace7c04552\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"610d27fbf7e70d25ca269c5f549054a67d35af30b7dd4fc784312db9cce4df23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e868ca29b1c1c2374441d92e4aaa1c6171e27635e90525412ba8c4bca24b59a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"585e58644bf42565979749c76320b49179d7aaafbcea3a586381c94c8ae91af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72285f03fe9b4e8619a5e1e3b78afb7d6a91af4b4ad126e8fe429adfa311785a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e39730b3bb03d3feaa6cedd97e009c3803c3c1e93b390e1f16359d23d2d4afa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7a4155a07f6048125b423c1b6d272d77ea9bc24d7c897587107eb429ab2ab7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2ce83896170df3c28b859812d6e5a676644dc9aa0c347553cf19f4acaa03543e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07613ec6104cadec59fd785bcb990b5a38ea5343d6c74a38a40fad81b771b119\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"3dcf1f4a73977a1dad8f77938e6cb8b3e54b2d46359776c5af2e11edfab95c49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"250065119d3baa7879803f41eb65b32f6614a6a3f80fb2d03ecce0cc0e65ddef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5e826c20dd5710a6b7e7446075da02d64e4b09bc44ef94e039edb05484bfcc06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf1e7d0ef8559d974a1323420a3d396a5f1224745470bf01e5f84f9e90671cc6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7770ced6938234629c72124c64149fa0906e6875d3620e7f2a0b2b905a384722\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af5e6bdb6b32a2da886759932798d61fc00c2948cb89ef707a8c77de30dfbfc9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"27878634d95404360b653257f3b03d7fb2006ecd6ce2978b68a1d115150e59fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca78ecd27c5cb0159528b820a7be7092275b9c5abdc62b572dedb7e627141373\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fde88c7e29be0745a9e8705f9903954fa2823d8ad2133a839db3d5ed96adcfb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ccf4f502d8f42eaace6b37e237896d6658342da096b8598da2567e1a97cd7a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"f53d7752e5e8872a28aaf4951c5bb99e52039e2d080871c4e28011c2328f2109\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0442670ca837fcdf5b5b65185966e09a927dc7aa7c0ef0689658297531f91c7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"55f4c111860bc29246c5f77e3c4e7d48647a53865883b40ae1e8515b9d02d7e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"496e1bf7f5641b54d2165111905fa143e0caac6fab14aa60c4c4ba36d8450772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c345c923befde091471bab05f155033e00973c1f4322f2d695969ef630cdaa8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6fcf011ad844ec14108de764b81b128fdb18fca9ddf8aba8087b147dd4f5bfdb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e36e9ef49d9eee750dd3bdaf13f7427ea50658d943798c5936bd4022a828fe2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"667d3a93329c566724f271b9c13e60b7d3bdba5a17c57765887854900434892b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"1826d28a53942692d22546698b1e127e9f6cf018551f0976553bfa20e5361993\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b79bb31b42338d4a406a8314ccd79dd125fccbb0f1321cba1e6e2a76810ca65c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"505c2b2acb351d14b73deb47ddc79ae294a4d0b7167b7f38f6dba24dbf4019a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb8bac264d82224c8d8c821d533af6243655e8d48c8764ba43c2d9a52e624ff8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c1b45264e1ceea9ba7c7c57d22e4cee07e3c66a3f40f55a0fb2a02229878d689\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2319eed8b4ef51b4414ccdc8857bd036554e70a55cfe750dc216906486952a53\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2eb301e5e4984be512b687e16a81a3a6a6ff2d80d4a23d38db2a15f8d2c5e23d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aeb0450fc0ede1b61e5bb1612230e6cc8cc7b2c66ff5bd0847078f3b01b444a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3224b08ceb25452655701219f7d2126150d377f4f0fcc7a7353e4e15cca11871\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8542b97537c28e07d57bd0a9c9474f31b46be9996c4e9bfc3475585960e95017\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7af45dbed1145cbefae25036f9b976a4ba04ff1bd6d65257c779e505c08e7664\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206405c4fb067243fdbd7964f80dd6bb48a9e3ce2c5335c82aca73c228e43441\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cae718fdd03b8a36914e865ce59f9f9820ec9eef12d4d0c9c6228b86a7fca262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"88058e8c9de15d7da1fea7024cba67237bdea366968f5e13ad3e9c0be8b34c46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"d78e0b7b2fff91bae4004dc0f09025510ecd9eb4f6ceef5f1004705995ee6e82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2028771388f8279a0773be1740d35e06fd4143c31788bceed01bae9e8689e4e8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cb1bb94e9eb8722108b82378027c9a6cc6927392f2679669c7127da5b93d7f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45b69d0a2617fdc908edabde94957a37df9bab4d7c8d1f0da2d3348571dfe24a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"58271f39ba379295948cabb3698a9f3eb43a28dfe7bfe008e8ed6a9586432164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8a5f0bed0ea44e46c7ffd9439a1c95a25744aaa30796c29dedf2f67e0718e99\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3588a32f4036d13fb6b19114219c46cf512773bda9a64cb8254668ce2f84bbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67f92abfa1830b39b11b6fba47fa111e608ce1ecaf6453884763534c3d3fb793\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d43defb9cd59af289b9dfd9879f86908b2485fde88b5f2ad80ad79a573e5025c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a38a3aae7b31ec5ea9420576df60ef9fc1ea0e252b9d3d96184215ce79b3226\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"de97507b575cf8eeb6ed5f8969e3e733c20f8d71018e39890aa1f57e803f4cf2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3e3834d3118318c51dffc32390603e36934595c5092fba7c22201192be37f07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"dea8f45890cf588ef4a93ce717a6523504e30c4b7c1cf6c22aaf2399d55c00f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-1c8dd4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:09.764Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-11ea30","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:27Z","generation":15,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5f9d701c-f599-44d0-846f-c2a7e5638d99\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:18:43Z"}],"name":"kuadrant-e2e-worker-w3-11ea30","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-11ea30","uid":"5f9d701c-f599-44d0-846f-c2a7e5638d99"}],"resourceVersion":"39099","uid":"d38a62c0-eb55-4f83-8e14-0f0bf8683fef"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"7e501414e2d808948b5eddaa7f3eb13b4877ce82957d2adebaf34a836c5ce444\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"fa4d09e98a2556f31180e48c4d9d80995168b68c25255a6617ff5fcec5af76d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"0e265f41f92f25d7807dc08172a944eaac20288601372a86e930f1345946c867\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"8ac3a676eccce06c93a581175c31eefc5da410e70579309c902ab32597ac5f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"099db7f703bc18e91019eee55e14ea78311b9e8c006a6d80178b4427969bbe2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"d167486b3a286179f2a574734132194356fcf46fe317fbc094da630cd968b226\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"59ce02df7fa04b0cc60f0ea6f22aa086b0f51340de5d6c38e7697282ade95583\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"4bd8db4d8fde3b6527fddb55cfec241fb481828efbf9384f3e0afc5cf1134067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"290bb37a29b764a67d6d28298d3b239bc4fa201a3722b25741fd74ee359cbca8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9be45ffa797958c72a1a39203c0b588ed452ee5d9d252c5df9004f63ed498d07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"ec7eda29a80355e79ad584ae112314a634ff966c3845c322adb4c7e30a115927\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"c946d75bac431574ecf87a5ba47e15caa560da872a09174b5036bf9f90c0ebd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"f7e700fd716c6572c297a61d035137c0a615240ceb902a6f605517e43cb3b51b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"024c8305fe118d0adf871619e5660208bb3382c0be529a41df5bf4c8b81e1a41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"02e591b14d1d911b248f6a57615920c164dc27ece5d75dc59e40f7c966017a86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"d6c7400827550730c2698f1fda6eab32d7ec1af6b7a019c1baa88a91919eae34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"48797135d73f587e843f75f61ae594882c62d94de2fad142f884d56b879787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"02778cc72718db248e0a19e01423d397465a06d51f9ccb69e6ebbfd24851cbf3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"5a8ec189257589d6eb2f8119a6e11a4ef922aa17b4e7f72784d8a4295931987b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"052c0658d6bef841b2dee7dfa4a1ac26c6104cb5e1b1b5ff1aa72d06ba0068aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5f33cfc21b53390e53f539550daf92821f9f9966396b0c1b8dffc81c79834ef3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"458fc67391ba189a51424b60a1833c6b3aac1b0d9a80b66bedc8a4bc0720cad4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e1263ac989787c1334fae799fad37ba5523a9c7fea8a3ced963e53e133ad05cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6634be4e1e349e075fa306fec4cc8d490cf8e09f34d63f6366662a1e5da80f59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"567cb1329c5ce873181f63aa9585b36cbdd31728ac0ff948e77b0038d7b0d639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"0cc742b9a303446dd9839593bb0c73439ebe804c6983e77f44562d58f11d5bf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"a1b7750bd5e7b7007476ebb57ac4209b2603ef7fba2a1dfc6830a5e86f72b5ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"533f5e66529af854e63da092f4998096cda919d44d8f250f0bee8346a83b561c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"60dc4f43d30a83a433e7a7c8ec26760512fe3b6834045fed257f83519e1010b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"397ec11215416691c2d8065d6f12e30fb013ec47cb386ea293533603ce3c74d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"ef2202f78c37e4bafa6be5121685839a838127cf98c583957df554688be0c13a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"61b462ba56beb0dd5c7a00db5ec898e65270993d6a30a37aa3f95c03740e42cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"6c33dffb6bfe6129da2f607bcaf300235c0c955b262eacfa84e45b66cbc52926\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"2831ae6371f9fcc08ab710fa949e52c2b1060e6692e034c9ac5336473e5e77c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c4e20feaa61d40b392e7c478b4878f1e369578fbfb2cdcbb2efa85fd0f42cb97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"7d11de4de428673bfe2ea958eeedb0f76eeeb719dbc4f94205024d3eb2d7a40d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e9bb7245f77cc45af3616db7e75d0905c9415f2cd7e6afb8e52b0903c5026fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"13f864bc48d9cb4c17311cc93c47e92f9e68f847b23fd1d989c1777bf12ecaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"ca4e394888dcdbbedd3071a78dacf7f7734b1637ce0022dd06d6c8d5db89a9d7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"3889c79f942fd5cd87050886fa73bf885ce15f36f46450a0b06680e03f0945e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"b51976e87d63318dca70c311ac6aa5346c87110ea930c83c8a7e6be98276cb68\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c042198a65c10a236d44152eb94d1c9ce282012744b5881818ac1c789776cc86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"064cd97002a8adf3f73a1c219c01ede3a466154324bf9c2d38ed802996fa1c93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"24055b76dd1b2b1074b2af17164520546ebf3584547ebb08222e57176c469cec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"0814649228590707265c0c5f4c05481a24e467825eb04f2cfe9b050cec451475\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"101523cf77328d6cc8d89b725b6358b5399ccbf12d0f5579fea9b252c21ed884\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6d1abdeb903d5c7409da81b9494cfb02588fce8bc268ce067c72281f3d2a3423\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"bd98fc62222edd4f185fb418cc21b343cd8fb7dadb018d20322923343b635a23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23582f77e306c43fbb9c186dd67dce35dbac27b48c88e55ce95f824242e5c070\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"4653b49e1df2d1ad70ac0cb086bd25a161a083daa5623830bf9c23a4d32d81d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d273924852db8aadf7dd4228e0f5a246820a4ddd31c0a3f987b9bee859fcb85f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"0f5c60927f2e0fa483306b2cb5bf209e25b290919908f47c32ecfb3f2d4ea741\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"b9f85a204cf99a8911948f83837caa2637e403dd000a62a8fc8effcaed065b7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5d80974a71752b455cbe1cf7f6745663ec15276dc551e435604c507fc7e1f824\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"8ad362d32578f96da0402397f19717a43bb6b422cc88ff4f9f1fcd9f9f051ded\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"996699b8fde3fe7b82d7fee633be4828868331af28fd31564d51eafe4050a887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"b6cd3cb3d8fe6c97811a84bcefeb660f7df86ee280fdb597ead5f618d1f1ff9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"50366813a245c7608d0499fe96aa6bcb2aa44c936eaff981254612745a5997bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"3287a60b3c10d53d6c1dc921ce50cc0e03b5652bb4969c0f98a7844bcd398280\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"a94425a593076417c83b2a40f12a8ae3c5c6b662ea65b8547feb3da20c01a7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"33b8c81c912fc47e6e2de04cb9f5de615ad2f5719d8c77a44640d718076dd61b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5cb8b3de52308e835c6dba6ef21bbbd5cdcc08e3a265f908db28054feb938acd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9ba49527c258b531f2ee72b000f546a9ebfd260a661984e53298846f5ebcce92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"ab28c9d732dd6eb9a5c664acc03cf1b527de0c2428670674b22dbf4902b0d28e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"797ae6033407ba51a6da601a47eb6f0aee25cffacff63d84822e2ead6e27cc17\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"e20a7320c56120af7dde4839033f5c4891aa05d7c9eac837d45775e251dd40bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"1cf89413c4e9b557bee9f2d1b259d19dd3bdd194fa97af466a817747d338f22c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"bceae3e6581f689850ae06da68761e7a9701cc2befc42b5db23b5de587eaa948\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6820726e004d8eb5c0fdc5bf7ceb2e9f78a4c533b6cd4ca0e024f6f2969a5489\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"3740f1f42e103769f8eb7f75f85c2046536e7cd0ead852ec9eaacc5bb6b1828c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"92a48cb8cba483dd253a3593c7e275206a0068f8bf2edbe9cc778c48036b80eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"dba8d67f8dc748e736bddfde9787dcd9f2abc4734b33904c161dad62fd54eb51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23e5d03604f396cf0f7722326bd1ab80ece27d6aa17559855854e8ee3826a9df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"f69075aec72ac5316b8ba068397d9bdf8b100ff775c12f10dc7c4a33141e4e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"39dd8dd5a8484f7acdaf3dc3a0c56c3398c524eb4109939c214eb63699129f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"28bcc6325fdd4b99a4f30057dc26255507ed669f632fedbfe422e47bc4af05f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"816c0d35beb47f6d90c29c30bffa876aa137bb36f61871cfa8a2aec40877b53e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b5cc0bb9c7d9964759f7998f9585e1e621c82d9037273b378114680ff9987fd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d6fc562ce8225bbeaea0c1a8d900c397a0f6ffdd32d289781d766cd6717275e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"222e4bc4c432b58101d67be0f5d1761ac686be63bd1cd2368af1e6ccd4ab2af1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c3128d5eb22209d5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"e76915430709bf5feb36050c9e422151d907c366bbb29f3971af1c955b350a6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4dbe5e5803ed030\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"fa6dfe6a45bf0083d1bbba31cc4b6ae0995579a3592c3a4aee778ecd3ef10c7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-11ea30"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:09.976Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7966af","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:11:32Z","generation":11,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3339de9d-533d-4f55-91d0-b84170f6b978\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:18:31Z"}],"name":"kuadrant-e2e-worker-w1-7966af","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7966af","uid":"3339de9d-533d-4f55-91d0-b84170f6b978"}],"resourceVersion":"38771","uid":"84d3cf1b-9529-4eec-8e08-c57c140360fb"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"8f671fe7fb5f95b66e479125c8b19fd0217da23efe9684323c945741670436f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7944c68a19f214e073476795452b68fc9f5c529621681ea36203a49113e60ea4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"44a37e2c7d3d57249bc83945c3dceef1cc1b386a13ea420490c3c498650356fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"55f6b7654a8478c1590ad97fd880538c4663712c8b5f9f65f533de7758a22fa5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"6c0eea8cb78db6808b765b480760119a06ee79ae8167f8d90831e4cb281cb055\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"4b8eaf23f03d065c5b264b0666f537c2a1f3ae7fc4800d616579730b9f10453e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"fee03f39e20b1fa1cbdef880cfa00e34a91c55cca98dd062d1232a8c504a2a8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"a922303cec22f7f675536511ea62683fd98789b99e59a1c67809c786530aae41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"53857e7b46c67135c4eea145b67cf842f3113bae4858e449b4d0bd56eef71c2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3ae896f044fa430bcc80634f8b4159dd74a9f5a95c90c59479a5dd22d0c0a777\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2cb7e6e19fbc4c9c857a59ce3a675c11eef097c10a58fd1655b73542355afa67\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"78ffc0a3105eab5a7fae567e63533e82ce53434ea80bc50692e1945291378838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"b9aad3b0a062c993c24c9d12afd48a040a60b2da90cb386f3c22af54c8c885b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"1dc52073af256dbc9bb4be8aaa767206edbfe0aa08db683e79d9c67836f18746\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c08b916a799c7312d7c549cad9123478e41f46f5b311664828e815118232009c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"9ca70c30491e45dd972040fc2132bc2d62a625825b60a0518f18455130575695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"0ba6095ced0c22c4974527bf1601e91ad26fdb9633a969255b40ac3b151b5e7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"c0b083ec2fc1a3ab9adcf766f5aee6a66960961c41c3c63836a6336fa945104f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"ba4fd17bdedfb57a0c3441c67ea8be06324527464c0ca54e0f7b1e020f9608c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"93832e579686254e6647bbe99864abdbe5a67d9fa759934ac94312f21c416252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"34d332f1eb88b2af92c85c8d2543b4528b4c50eda75d3fb6aee69daef2c453c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"66d98bd56e776500d44f45a0859b97d4562983d2260958e379ea35e9487ad4eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7d5b6ecac99a81903af1f07695f086c4bfd109bafab8f8194ad4b4fd091b34aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"b2b4d2e55bb399b589ee7e5e2cb4a7f725f020a25a59dc6455aaa53dd45398d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"7d652c0a553e29fb216d2deea09e5c3346e0879578a2d9458153f518172aeb13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c9017f020a8779df1bf1a4aa893cc309f09fc238e8d01959aa19111eb0b5ed65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c6b72d0a40389b38ea00360fdbcf1fb88e393c234225ed00a5a7c17770d9effe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"273f3c97f0d3804192fc0e01200c142ec51c874dee497a0c443d8b979e048ebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"3c2eed2c4076ab0ac01618527715b342fa5ecc8d9baa7c79f1feeb964c3799f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"6849f90c55719b2024e77469af36a9418435813fdba53de85548fc45c8041b2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4b68355e16dffced958b3c6cf6a85ace82156bf11ac5213f8a94b85b21483dd9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6e4d91976aaaeb7700bda58ca9f7d4fc8747fc30b47ad671e61c49301d3138c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e4f4c91d80ecb2b9c5e16dc7f16c85265f9b25ba1cdedb41f12bda22dd9a979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0ed28d60417f2be6fd8d8ca4e4f44017f1958dcb5f04c4b83faf3bc6eeab4d6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f475baaea88901f678e1e61313882f0906b83362598efaba02eeb7786e00c4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"bdebda30124b2b8564734f643be613c091aa384bca2e55611ab88e7cd4cd1e3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a31f206ab8dbca0afdfa573363aaccf106a7f54a5ec5ca868f0491263074ecb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"251af245b620a7fa0dd508c8b95ff9e02509b8bbe434073cf9b83ed0bf227633\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"413bdc5e3c8df93edf127de1f068c54db611a5add63e857a73c37db5c6778c81\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2dde942f6b0efa7d7693b097e74d457342dde9cd9f03e35cf7d39070c096b740\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"860dc65fe8df4fdb17f386090ff27961bc6e43ace3152d5a0c9832e5477eef9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3f40a08f9e67e8dea27e0ac184897b50a4a576eb35780ee92df8400cfcf89d70\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"19f5445fe08773500d55b3e72f93509c2849e7e895c1622c020ddc87da19fffe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"400cdf544c87d2cdde4a5d3684f85f830b61d03ef5e1b02d0be1783c7c45c882\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f540b85497841fd97f6f21f83df47eb33faf6a12440f4d57614189d4bc7e3f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"36893b95343f134093b02742f36ecfccd053fee778fdc4f679be27f0821f963c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ba6e1647cd84f03625de8a02d65d855c5b7014eccd9876502769172d848baf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"90d439ca579d037200d4b9b1351688c85e60d2b62c325dcd4c864dbca1f9aad0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0c780dabd6df0d31a9112fdc030e2d5ab45c634fa34c405e7c67193ba45c772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2b0c90ffa9c94815d4d916e763f757d711b83e43dc08707df89db7d8d8406388\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"22d7d611d13f7efc7d2839b9a4d644f15fce375261b2ef9f4c6f4a7c127c986a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"078831a5d217c20da318ae12d6aa231e9bbff23ac0abcd2591db8af03a0f020e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25b24056e5f00ce11ef07850b2b553069f88dfd09550c0f5ef9bd3abd7e8698a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"b093acc088f5b3c6abf3efd2b7e49c62fb4973951ca4bcb2de60b577d838bb0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce534ddc012dd199020559b4cd72e77478d843282db2cc920f6188c0ac48b895\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"fa2a9ebdd28b4100f82ad9bdbf5df9c5aa1c538e9c152619e7c88e18c7d108ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8dba5b80a8bbf465d2b8b22eaabcf3c0bd9ec9943de0ee152b6ff7246eec108\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"2213becdc51c61f7f2e2b6864f2180180274ae136569ddccfa233df684854720\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a2d41d1bfe2845a09f9c006079e27f8bda38d62da8cf25fd8a189dcff49f66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8b5df53b7e5c7e22beb55f83245651dce6a8917bcdf2dd35bc44cc2e3e651fdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbdcc0f989595829fe92a8e9a32d69ea8a40d9b8cf10776562925da6cc33aeb2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7373120acb8fd2eb2c4957816e801ab94992057655f4e91e779b8aba2001382a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa6b3088cedb629d50bd69ee631bdffecde5a774bb58b1674ffbb601ff8cd135\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4e5201a1a8ee2abf1581a722b9b2764742922db1f0ff711794e338b7f65d0371\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda9555e5eb3a15f39830032fce44310c889ff832fd0ad45064af7e4bf34363\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"ef25a425e1d6dfe3f23ef10f30a834fe7f3b5ec9eeab376d9f7fedbf161693a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"715838e358b45a42fdfab1383d224600a95382ec941889a2a8cbf028b75f2333\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"f1d83a408601470954b72d92543728a94b837de1f26ba9bcea2689e096a9d18c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486256a75c498ab148cc9bb46bcea251297e2b74e1cf34bad3c55c74a14573c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"99754b4eef34970705761ee0d474fac3c0af931cfc8eeec218184e704566664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b402fefc886c9554b97ff3213c74deae584634017111f44bdedcad110954f5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"cf8a0e7503866d654dd35b207f84dd9afb7d006187b956dd25ac362a1582e4c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdbee3a9bd7f4b5ab291b0c7d51f26f71e9fde499c7da46ea9b0e5cd6486764d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"289d88ae80ca96598acfdb993945a9a7bc9728d40a7752db7cd5dfcc4255cf87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c01a1bbd47226264fe8f94e0d3575ca0ff85f4d02cb4b4ce6550ff37288daa4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"beb7bad3db035dde2975e132668d9e271e70d2a74fb9bf4ea61939150d443fbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75b7df72e9c7be8b9431666359ab3de5e8df05448b1f4b0276e5456fbcbb30a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"6ae83b4faccc867bb2b6cd562e04a27a61b810d3207c407f63565cd861a705c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5516d78005de2cfe8956e3ba1e8ec342a541cc4002706d987fcd519d0b67cf71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"dfaf750c9abe122c321117f70e65b282b6e2c59110bb0232a53f861824281705\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4556062116dd6b1b9e44244b886671cebc576038b0f9c1c1fe3e13deefafa523\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"5c9517da623973c54b0e61ed81b97b5019e20a39cee4222e9c2001fdb37f61c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa04b5c8a50845ad82f4ea9bd5f1f7c759ce4450149519bb00523b008482cb75\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6052d33df74209b62973bde64ad856897511f6c7fa48511e4a12fdc24287a50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad466fcf1c5c4d7345f6eb4fa5808cff0469e236def3863eb4783f677353d152\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"effd523d3498f1d53a6191e49c89ec1a161c7bcacb667779c6d8003047645c13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e8588abbd835e92bd8170bc89597b0d56f24271385f73e5fad17ec99a7389718\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"f4b7585e2b62ac0a7dbb3a671941f9be5fe33ba4c89700d7d3d938c179517ab4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08d9d2aa5fadedf5c6dfbc45eb4f9c34ea2a1882947995b5c79a92c618dd8d69\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"182222bc7dc75bc923b9c50cb3480521ab543e3d3f58674f35fa711b4a4fa69b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"061c7e4d1b1d8866722f6c06899571bde9ea56d77ea14ff59cf1d915e2d9b1c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"d755fedb11567ddbb0eb17e40e71678bcdffb7ce224b77d1c35bce75b6f556e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de657ac3c36b9a560af065f79a5ee929b70dec023b7155afc6b66e41a52fb273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"43f437f56d846d068e2783e265d65343acc185d8e9b1b43de9a84d4b8a4bcf25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c39303e83fe285ea577e6e31ef4627d8e9c1575ce9cbf3c5585da04dc9c3146b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c03721f568137f1d8835419637c079a8fab9caa0309f3e0567b19d99133eac2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7eedcaf178c841ed379be213f3f34665f16bbe619f0fe9ef35d71b19c579b94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"aa1b2e83bb519ec79fcb87c4512f8421b5031a1f66602c9fef9caa19a2fecc9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6be017c8c4a655f626b1a60defee892156238e99009d2e530b9cb9de189201a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0f30b14be9585141d957a722c9bee91c27f7cf218fba3d4916cd634fa6b8c5f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e43cec109a35717b74a3a54ae0f1006635a20b91c9de1e75a82c32f0339b4ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"0eb8bee651ce7b42a148f283b008ad1b9eab9530a3234bdeaa371aa9074c6141\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f17d178977a829b7cb25e144281dd8bc17cfea4201e8f9d6e4abd729b51db1b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"15b69076679c9ee18f60045fa3138d011c2d117b2656f00acad6ea10179f5206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ccb310d1f482e6b78361f68b84c67bc46f7ad1c23eca07e13b5c6a27a096cf5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3006c2eb1cf0340b97d9cf4bdbdd7cea90026fcaf2fdfc3dd08c8e58ceae1938\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3eb001e52c79b1aa88f706bcbfda6899dd3d8312d2217dbb4f6b058a4602615\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"993295647de89316ed5016fc8beea92b6a66a8b34e5282043de690d88ac6d739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaae91b1f31dbd6654a5fd3c753d7ab2f9a54c9a352837dfd278c60a0fd25213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"411aef1a70bd99e949e340f4bff5dec9eb942d0e06e7075a78d572b412b7a939\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c928bea546bc63b3b8bd5d85d7a8f44207359e9772db70e9d65e9a38a136764\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8be814115fb7da807809a189087e4e033d326542da651f00ae28c8f14a5a6838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b458934204e7bd220bde8b2123b49c7fa677b901b7dc883fd85cbd8bef09f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"16517301869349c194fdc9624b1d4ecbd0be903f42b8c985af97867cf0023016\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ef3137adb71b08c83f1177afdfd70e3ceb53eb40eee682f1eb18aad1359fc66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8c7fce071dce1e65b18501c98e406d87231372ae5a9f5e8c347b65788df91aff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b13167a0b9b904765e5c7590d0ff54a0d4055061140144c50ac8d78e7f149e30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8e181d00f8b265fa8906db42847f65f424eec53caedb83469692e55f37e669d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a4b7d2121c1a0b6ea0d6f91f0b6dfca2759729cfe994a2eb6a6667e6b4edd0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6713bc99135c617edeeaade68698ecdf33d333131a77de2650c51b3b2fb36ef9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5eb305150bdafd8cd17ff8f66d77a2997545fb016d4fc2403dd456d505ca0b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"01277e6b7cec6e52c5ed8c8a780cb7fa31f56958fa93a2a5627034febf8791e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec9fcf7e18d4cac0d461636f2eca5067beeaa5440b72ee39b4f1cde5931fe481\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"41c187b864990629cecc9d75d09c283380fe5f99f4b35a1ec1a6932fb112a785\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9d90b0ca5be53b16d790c3082127cc7315e4666ae929559754734de0429c8be\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" || auth.identity.selected_subscription_id == \\\"26d47ad763b4e4cb\\\" || auth.identity.selected_subscription_id == \\\"4fef1a0aeb3edd4f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"4b58c3803487d40cd3d7d9dc63790243a7353b4a1f8b9fd9ae2c009fc55d5d8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"26e65caa35770dcea82c3bc46eb21156e68b0f237e536d0654e8b461fea79765\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"443894938bd03a0c0dfb1a13d4e30954bc3b4aef05764e52dc4647fddd6751e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a8bde041ff87e0d7ca43c9b2cb552d0278f317b6db01967ac7e2b21386b4bd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c1e45b5496eca64cf0b773c04ff151ed5a4c0fb5e66b08193d6941fdb5aeadbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1945604402dab22a2bb92e179c6db3181c9764e9e4b91fc7ed2f36d11c05b72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"d2cbb037fb718698317e136295b45ed06d5851b3e4dd7b69cc5d4284cfa0e31b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7966af"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.187Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-de0ea2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"6e7eb8f6-4c81-49df-885a-1cfd92034b41\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"}],"name":"kuadrant-e2e-worker-w4-de0ea2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-de0ea2","uid":"6e7eb8f6-4c81-49df-885a-1cfd92034b41"}],"resourceVersion":"37348","uid":"ad417c34-a43f-49c3-8386-dfcd19d97287"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"8f41f5d27f92196508ddee2fc47e51daf5af5c4825a7e8591ede0800be949fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7a4e12ba594de064264e5a79bafadfb910f6fe0c5c088cc1d86aa478feff909\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"545e35b30c59a1aa62ea994b7a5be31f8d3760ca10aeb1ba456d4eea87cf7a6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"a4133ad72b872fc03206a842894304ad17b775369b97a617c5b595bdc943e826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"771078d889ef85b81946eff0b2ff32fbabcda38cbb208fa37bb96509f7d979a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"bba5991046822f1b6e0758327a2491b9658a798d2b607b2a7144f024f0067676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6d451581ca6171a655cb504496641e173bb76b72741c6c02eaed94083a536735\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"46cfece21c467f625b03ba5a104af0b1e8d4a213c5695ef30a112544f1c16cbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9d157bb2d1741f38e7e5854412ecaf7c47f4b489927c97cca666d33d1bb4d834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"a6089be44340b73e309196db9a8c89f042bf2d2570f1e88b8378d364827acdbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d186d8e5e42a867e2a08face337b9772aeae6ba493c896ca867692f02c4456e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"8d1e7b487515ecba92117549552071598f9233e149b32fc4eb13567225116a07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"68a9c4eb18e71677a594352b1b7ad0325a4c685212ace060db3b90da668c6f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"5cd2749f5fa499321c3a48c9e432951a046807348668fc35fed27b72ac6db3cf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9d55be3daa24118dde3ad2d28e0c6b48c00dd4df682a4745fb2c1e69a0bb735c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d5d96025b93f14012073fc9c61dbf91db95fa9ca2b726ddb91f601e538620862\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"06e46d8eb2da8005de0d157a8845a587567d7612ef6f79fc810ddaf2f78d6bb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"66272d32af643987684100422c0268e207c651a098012b0f2f6c77f68bc6d25f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"84d595c1af2ff8ed9ca0194212a4eeb97f3de15fbf7e225e4c6eb56d5a39f8e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"c13145cd6f1056971233d0e758c11ce8cee133a64eb3cf6a02b122d5a29a71a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"31e47065c52fb96c2470ed21a3d45c533ef5c080afe214081ff5637fa2b0d420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1b9a9d0030ed877e95dea36c3d55d7589cb8b6b826be9455de9bcdccb31c4a39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7db200bfe44cc9433850257d064b4edb5240dd6951e2251e271d79ce2599c45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"042db8e6145979020b4aa2ccc468918dcb1f32d03a1880a86a855cf8560eb16f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"5c91323526e4e1197474b1874d1ec0a636c457a84e2013e3688214b3c9f40292\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"56ff390a2f15a60052acfb6c577c0d99916ec6f8ec0c500a95983e8cd3ea840a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"26bea37b48ab2ee00f259c3b8c9bc4c47b26a86a798c02dc31f2843e47829ca7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"19013eb61834602135d4d3c8ffee368d3060b9b63fc5f9bf0951d431b8c38fdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"3b814cb972103fb740b36a5d13d0e90ab61a2243933f933f775c42677c1a5d85\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e7c8f0c364705957418c58fc49a204d16bc88650633ba572edfd632ab77f5666\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"91cab405f0636396c7771c6dc75f806c2ca022fb0848ae3c2fcbb33e22a339ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"67532e0078356f799dfcf346f3e77095d0c624d2d10cdeaa6e88f469fbb87049\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1b04bb6432aa7ede0fec0fc20a68d9446f453e5c05a3adfd45bf17a6f8b9ebc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d0d9929f02171b1ab4c86941d9f44cb58b54eeb19d2f221229eb30f01bcf7375\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"566ec84294cde50603c3dfa36bdf2a31651f5466d00e709b76f896a26cdc6f50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6bf0b16aa8962b07d84f7048f7b90a0b18983bd80e9edb53eef17bed17344e99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"12b5dd9ded539680a4677101fbb814ed65f93d791dfecc06a4e34ac1ca666285\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3feb12b2847f536be51d0b1e92294157bff9383e20f2265f92e3ea76cb048d9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9b267730031d7c70062f248c5d4811c04b382ca0287062b64928d46b92989d20\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"fd11e09603fe10b92e5b13701b94b1bc51bd77fefaef648e1161701b5fa58e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"68bd4c49aaa83b70448e00df2203ce7ce94bfe9c263e924f642ee7ca2732c5e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"f72767414d30bcfd4e1eb5788ae3b97e09949d30d08ca78756af19a21889315d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"685672fdf62a49b437cb02b0a5cf31117061b1cb305120627a24d822b87448b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"28b61973b7f554ada23df8f2adbcef9c3140a267f58ebf2ee8fb91ca7b72c4a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dac478a38580f45da71c649418701234a58fe64e526cb6afb7481ba444836b2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"36b0f5aa2c414392caa7ffd3bb635d11e950c904103befcfeb425d09f5b9dd48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"90c38ac2efd8fc638edcb5f7c8693ef7a3280fbb60b050b3849a607a39eaf69d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"03f1f356a7d76e767be8c0f275a64f6b98f09a8f3d04640561ef4c3f580d2783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"4402031351082e527488b2a5cccf7d68722dece1fa01370d5c21333ca6505522\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"b9c11f37fe72e97b7a55dae48d999a758e39f367ad7a116d7c28ae2380778fe1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1fae005cfbffbe4e3aaf50dbb8dd3b5a9f584045e1475c7738a315467ec67d5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"135dd5eacaaaeb159be4c9871fe73af3bfd928f5de1be32e147f296965866b96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"336d069594861bb5e759f874cb7b2f97e4c07a0dcd6170a429970f5f2d53ac0b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dfc32b1869457c56bed8d097b7c0a22a2a0b12e527f2acb8733ab9067d057c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e25322c24d98be7252f7c79cda0327987ee6ee4733d332ed5901e1b273397c89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"00bc5328f6973fb2115cb694774124ef334eba1a1cfc7badbab358850a407a44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"1f9f53047b22c1c17c09acdb0fd9c17eb0638398ecc1a9a37a86b01d811cccb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"96d4f3037b42b8b4dbb2b4c60ec972ab8af4ae9746f33d3238fb10f28f178b9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"310e1acfd0057c6e83529a4c7d8365e210e81104c28ddd0e12bf7c27c4f96a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"78c96b65770748aed921a19b6a2bd36cc8321c0a7dec5651a52e25bab7ad2164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dfcdd2ad233477f91e46e790091a8a25cccde3e540e5dfee8a882e70548b396d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"32a037705f978b303327717e1c0ec5e2335c0b26c10797f521b5135cf6a2453a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e6a99dc788b835aacddb6627c89f73143a475188279769039fa67efd06d375ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9960c39f056ac6bfdf36a15fd9c1fa7c853b27ad278ebc44f7ec6e94d68172d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"7287734b84ceef6341393a90e3ed4982016519f2ef7f9218e0807c5b41fe5f8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"45872a4dc74f3d9c8887e6e6522fcc3828da98c8175226158ad7d1e0d3a30127\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"688f84a7dff8577d0e7ac9a7d4ec36ff7dbdda50d779bc6b57d6aae8ce8b2fa7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"435ffa54404a9fbb884e542d138a68cfb6613f929fac5c1d075c32a78366f2c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"41543e9b40d595358566e7bb5bcbb2fccbbbe2135adcd30f456cbd888d802a5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"4aa7d5ab26c862da3f59d51848309ebfd14dd317c39eeefa3ea8a80838fbb716\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"80cec2e610c1806df05551724b800f012f0c084c1813547c1bbd670985b653f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"74df5489e7dfa47ee79eee83e342918f6531e925cfe1a798956b35da601d884d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"ceac94fca2ae9ea5cc47f3df0ec9d6a10b6251c722a213562fa646ea167dcdce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e619c29e635edd15be7867ccd71c115af280811a435be9acf9042fe6ce2369a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"836cd1aaeda4d6b267aa83969a7f76f361d3884106e3fe9a1a411ebc103c733b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"58317c757c8a458d1a8d6d5b7d8a3528d73c19d945347d61d3167c58a9f2abf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"811ca47fdaa1feef5760290388150e142b3763ef459a60d86cb3e223c6af9a2e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"484761bfa30c42040a68a552fd37e9c6794f6d1979ee07beb44e5d6b81c5f2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"c98397041d5e3535484e38692edcddb66bc94af55a8aefe7b372827b5b9a3658\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"df7b3104a100478ba86ef3efa2a83b687d49ec85b07c62e635a293b710028281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3fe8aaa75098b89c44ca3fe5a5cfc62dfa76bcc518cd59e8843f2e901b0a131d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"cfa45a246c21e687ad88a5b47e3484a2e94f500826f168a1b20a49a1094bc73c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-de0ea2"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.440Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"1f2205ad-4e14-4879-90df-07f9a9d90e1f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.498Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.557Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.616Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.737Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.795Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-sw-d71261","namespace":"llm","uid":"ab860901-e5c3-4d5a-959b-20a193caf018","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-sw-d71261\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.854Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.912Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:10.971Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:11.152Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-eq-c29cf4","namespace":"llm","uid":"e3cb96ff-d27c-42a3-b43d-f484aabda347","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-eq-c29cf4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:11.210Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:11.329Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:11.387Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:11.505Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"fbe58237-7261-41f1-ac9d-8d7ea90d5267","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w3-11ea30\" not found"}
{"level":"error","ts":"2026-11-04T00:19:11.624Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:11.682Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:11.795Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w0-1c8dd4-kserve-route","namespace":"e2e-models-e2e-worker-w0-1c8dd4","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w0-1c8dd4-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:11.866Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w1-7966af-kserve-route","namespace":"e2e-models-e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w1-7966af-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:11.933Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w3-11ea30-kserve-route","namespace":"e2e-models-e2e-worker-w3-11ea30","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w3-11ea30-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:12.058Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w1-7966af-kserve-route","namespace":"e2e-models-e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w1-7966af-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:12.140Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w3-11ea30-kserve-route","namespace":"e2e-models-e2e-worker-w3-11ea30","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w3-11ea30-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:12.237Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w4-de0ea2-kserve-route","namespace":"e2e-models-e2e-worker-w4-de0ea2","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w4-de0ea2-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:19:21.337Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","EnvoyFilter","AuthConfig","HTTPRoute","ConfigMap","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":24,"delete":2,"update":28}}
{"level":"info","ts":"2026-11-04T00:19:21.638Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:23.226Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:19:23.435Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:19:23.435Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:25.765Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:19:25.770Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:25.770Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:25.786Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:25.825Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:19:25.856Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:19:25.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:19:25.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:28.892Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:28.892Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:19:29.336Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-1c8dd4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:19:30.054Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":4,"update":1}}
{"level":"info","ts":"2026-11-04T00:19:33.420Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:33.428Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:19:33.434Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:33.434Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:19:33.487Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:19:33.487Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:19:34.236Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7966af","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:11:32Z","generation":12,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3339de9d-533d-4f55-91d0-b84170f6b978\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:00Z"}],"name":"kuadrant-e2e-worker-w1-7966af","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7966af","uid":"3339de9d-533d-4f55-91d0-b84170f6b978"}],"resourceVersion":"39766","uid":"84d3cf1b-9529-4eec-8e08-c57c140360fb"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"8f671fe7fb5f95b66e479125c8b19fd0217da23efe9684323c945741670436f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7944c68a19f214e073476795452b68fc9f5c529621681ea36203a49113e60ea4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"44a37e2c7d3d57249bc83945c3dceef1cc1b386a13ea420490c3c498650356fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"55f6b7654a8478c1590ad97fd880538c4663712c8b5f9f65f533de7758a22fa5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"6c0eea8cb78db6808b765b480760119a06ee79ae8167f8d90831e4cb281cb055\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"4b8eaf23f03d065c5b264b0666f537c2a1f3ae7fc4800d616579730b9f10453e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"fee03f39e20b1fa1cbdef880cfa00e34a91c55cca98dd062d1232a8c504a2a8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"a922303cec22f7f675536511ea62683fd98789b99e59a1c67809c786530aae41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"53857e7b46c67135c4eea145b67cf842f3113bae4858e449b4d0bd56eef71c2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3ae896f044fa430bcc80634f8b4159dd74a9f5a95c90c59479a5dd22d0c0a777\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"2cb7e6e19fbc4c9c857a59ce3a675c11eef097c10a58fd1655b73542355afa67\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"78ffc0a3105eab5a7fae567e63533e82ce53434ea80bc50692e1945291378838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"b9aad3b0a062c993c24c9d12afd48a040a60b2da90cb386f3c22af54c8c885b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"1dc52073af256dbc9bb4be8aaa767206edbfe0aa08db683e79d9c67836f18746\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"c08b916a799c7312d7c549cad9123478e41f46f5b311664828e815118232009c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"9ca70c30491e45dd972040fc2132bc2d62a625825b60a0518f18455130575695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"0ba6095ced0c22c4974527bf1601e91ad26fdb9633a969255b40ac3b151b5e7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"c0b083ec2fc1a3ab9adcf766f5aee6a66960961c41c3c63836a6336fa945104f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"ba4fd17bdedfb57a0c3441c67ea8be06324527464c0ca54e0f7b1e020f9608c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"93832e579686254e6647bbe99864abdbe5a67d9fa759934ac94312f21c416252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"34d332f1eb88b2af92c85c8d2543b4528b4c50eda75d3fb6aee69daef2c453c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"66d98bd56e776500d44f45a0859b97d4562983d2260958e379ea35e9487ad4eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7d5b6ecac99a81903af1f07695f086c4bfd109bafab8f8194ad4b4fd091b34aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"b2b4d2e55bb399b589ee7e5e2cb4a7f725f020a25a59dc6455aaa53dd45398d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"7d652c0a553e29fb216d2deea09e5c3346e0879578a2d9458153f518172aeb13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"c9017f020a8779df1bf1a4aa893cc309f09fc238e8d01959aa19111eb0b5ed65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"c6b72d0a40389b38ea00360fdbcf1fb88e393c234225ed00a5a7c17770d9effe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"273f3c97f0d3804192fc0e01200c142ec51c874dee497a0c443d8b979e048ebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"3c2eed2c4076ab0ac01618527715b342fa5ecc8d9baa7c79f1feeb964c3799f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"6849f90c55719b2024e77469af36a9418435813fdba53de85548fc45c8041b2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"4b68355e16dffced958b3c6cf6a85ace82156bf11ac5213f8a94b85b21483dd9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"6e4d91976aaaeb7700bda58ca9f7d4fc8747fc30b47ad671e61c49301d3138c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e4f4c91d80ecb2b9c5e16dc7f16c85265f9b25ba1cdedb41f12bda22dd9a979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0ed28d60417f2be6fd8d8ca4e4f44017f1958dcb5f04c4b83faf3bc6eeab4d6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f475baaea88901f678e1e61313882f0906b83362598efaba02eeb7786e00c4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"bdebda30124b2b8564734f643be613c091aa384bca2e55611ab88e7cd4cd1e3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a31f206ab8dbca0afdfa573363aaccf106a7f54a5ec5ca868f0491263074ecb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"251af245b620a7fa0dd508c8b95ff9e02509b8bbe434073cf9b83ed0bf227633\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"413bdc5e3c8df93edf127de1f068c54db611a5add63e857a73c37db5c6778c81\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"2dde942f6b0efa7d7693b097e74d457342dde9cd9f03e35cf7d39070c096b740\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"860dc65fe8df4fdb17f386090ff27961bc6e43ace3152d5a0c9832e5477eef9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3f40a08f9e67e8dea27e0ac184897b50a4a576eb35780ee92df8400cfcf89d70\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"19f5445fe08773500d55b3e72f93509c2849e7e895c1622c020ddc87da19fffe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"400cdf544c87d2cdde4a5d3684f85f830b61d03ef5e1b02d0be1783c7c45c882\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f540b85497841fd97f6f21f83df47eb33faf6a12440f4d57614189d4bc7e3f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"36893b95343f134093b02742f36ecfccd053fee778fdc4f679be27f0821f963c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ba6e1647cd84f03625de8a02d65d855c5b7014eccd9876502769172d848baf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"90d439ca579d037200d4b9b1351688c85e60d2b62c325dcd4c864dbca1f9aad0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0c780dabd6df0d31a9112fdc030e2d5ab45c634fa34c405e7c67193ba45c772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"2b0c90ffa9c94815d4d916e763f757d711b83e43dc08707df89db7d8d8406388\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"22d7d611d13f7efc7d2839b9a4d644f15fce375261b2ef9f4c6f4a7c127c986a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"078831a5d217c20da318ae12d6aa231e9bbff23ac0abcd2591db8af03a0f020e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25b24056e5f00ce11ef07850b2b553069f88dfd09550c0f5ef9bd3abd7e8698a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"b093acc088f5b3c6abf3efd2b7e49c62fb4973951ca4bcb2de60b577d838bb0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce534ddc012dd199020559b4cd72e77478d843282db2cc920f6188c0ac48b895\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"fa2a9ebdd28b4100f82ad9bdbf5df9c5aa1c538e9c152619e7c88e18c7d108ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8dba5b80a8bbf465d2b8b22eaabcf3c0bd9ec9943de0ee152b6ff7246eec108\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"2213becdc51c61f7f2e2b6864f2180180274ae136569ddccfa233df684854720\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a2d41d1bfe2845a09f9c006079e27f8bda38d62da8cf25fd8a189dcff49f66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"8b5df53b7e5c7e22beb55f83245651dce6a8917bcdf2dd35bc44cc2e3e651fdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbdcc0f989595829fe92a8e9a32d69ea8a40d9b8cf10776562925da6cc33aeb2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7373120acb8fd2eb2c4957816e801ab94992057655f4e91e779b8aba2001382a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa6b3088cedb629d50bd69ee631bdffecde5a774bb58b1674ffbb601ff8cd135\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"4e5201a1a8ee2abf1581a722b9b2764742922db1f0ff711794e338b7f65d0371\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda9555e5eb3a15f39830032fce44310c889ff832fd0ad45064af7e4bf34363\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"ef25a425e1d6dfe3f23ef10f30a834fe7f3b5ec9eeab376d9f7fedbf161693a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"715838e358b45a42fdfab1383d224600a95382ec941889a2a8cbf028b75f2333\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"f1d83a408601470954b72d92543728a94b837de1f26ba9bcea2689e096a9d18c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486256a75c498ab148cc9bb46bcea251297e2b74e1cf34bad3c55c74a14573c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"99754b4eef34970705761ee0d474fac3c0af931cfc8eeec218184e704566664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b402fefc886c9554b97ff3213c74deae584634017111f44bdedcad110954f5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"cf8a0e7503866d654dd35b207f84dd9afb7d006187b956dd25ac362a1582e4c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdbee3a9bd7f4b5ab291b0c7d51f26f71e9fde499c7da46ea9b0e5cd6486764d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"289d88ae80ca96598acfdb993945a9a7bc9728d40a7752db7cd5dfcc4255cf87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c01a1bbd47226264fe8f94e0d3575ca0ff85f4d02cb4b4ce6550ff37288daa4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"beb7bad3db035dde2975e132668d9e271e70d2a74fb9bf4ea61939150d443fbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75b7df72e9c7be8b9431666359ab3de5e8df05448b1f4b0276e5456fbcbb30a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"6ae83b4faccc867bb2b6cd562e04a27a61b810d3207c407f63565cd861a705c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5516d78005de2cfe8956e3ba1e8ec342a541cc4002706d987fcd519d0b67cf71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"dfaf750c9abe122c321117f70e65b282b6e2c59110bb0232a53f861824281705\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4556062116dd6b1b9e44244b886671cebc576038b0f9c1c1fe3e13deefafa523\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"5c9517da623973c54b0e61ed81b97b5019e20a39cee4222e9c2001fdb37f61c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa04b5c8a50845ad82f4ea9bd5f1f7c759ce4450149519bb00523b008482cb75\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"6052d33df74209b62973bde64ad856897511f6c7fa48511e4a12fdc24287a50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad466fcf1c5c4d7345f6eb4fa5808cff0469e236def3863eb4783f677353d152\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"effd523d3498f1d53a6191e49c89ec1a161c7bcacb667779c6d8003047645c13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e8588abbd835e92bd8170bc89597b0d56f24271385f73e5fad17ec99a7389718\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"f4b7585e2b62ac0a7dbb3a671941f9be5fe33ba4c89700d7d3d938c179517ab4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08d9d2aa5fadedf5c6dfbc45eb4f9c34ea2a1882947995b5c79a92c618dd8d69\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"182222bc7dc75bc923b9c50cb3480521ab543e3d3f58674f35fa711b4a4fa69b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"061c7e4d1b1d8866722f6c06899571bde9ea56d77ea14ff59cf1d915e2d9b1c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"d755fedb11567ddbb0eb17e40e71678bcdffb7ce224b77d1c35bce75b6f556e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de657ac3c36b9a560af065f79a5ee929b70dec023b7155afc6b66e41a52fb273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"43f437f56d846d068e2783e265d65343acc185d8e9b1b43de9a84d4b8a4bcf25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c39303e83fe285ea577e6e31ef4627d8e9c1575ce9cbf3c5585da04dc9c3146b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"c03721f568137f1d8835419637c079a8fab9caa0309f3e0567b19d99133eac2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7eedcaf178c841ed379be213f3f34665f16bbe619f0fe9ef35d71b19c579b94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"aa1b2e83bb519ec79fcb87c4512f8421b5031a1f66602c9fef9caa19a2fecc9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6be017c8c4a655f626b1a60defee892156238e99009d2e530b9cb9de189201a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"0f30b14be9585141d957a722c9bee91c27f7cf218fba3d4916cd634fa6b8c5f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e43cec109a35717b74a3a54ae0f1006635a20b91c9de1e75a82c32f0339b4ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"0eb8bee651ce7b42a148f283b008ad1b9eab9530a3234bdeaa371aa9074c6141\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f17d178977a829b7cb25e144281dd8bc17cfea4201e8f9d6e4abd729b51db1b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"15b69076679c9ee18f60045fa3138d011c2d117b2656f00acad6ea10179f5206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ccb310d1f482e6b78361f68b84c67bc46f7ad1c23eca07e13b5c6a27a096cf5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3006c2eb1cf0340b97d9cf4bdbdd7cea90026fcaf2fdfc3dd08c8e58ceae1938\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3eb001e52c79b1aa88f706bcbfda6899dd3d8312d2217dbb4f6b058a4602615\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"993295647de89316ed5016fc8beea92b6a66a8b34e5282043de690d88ac6d739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaae91b1f31dbd6654a5fd3c753d7ab2f9a54c9a352837dfd278c60a0fd25213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"411aef1a70bd99e949e340f4bff5dec9eb942d0e06e7075a78d572b412b7a939\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c928bea546bc63b3b8bd5d85d7a8f44207359e9772db70e9d65e9a38a136764\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"8be814115fb7da807809a189087e4e033d326542da651f00ae28c8f14a5a6838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b458934204e7bd220bde8b2123b49c7fa677b901b7dc883fd85cbd8bef09f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"16517301869349c194fdc9624b1d4ecbd0be903f42b8c985af97867cf0023016\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ef3137adb71b08c83f1177afdfd70e3ceb53eb40eee682f1eb18aad1359fc66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8c7fce071dce1e65b18501c98e406d87231372ae5a9f5e8c347b65788df91aff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b13167a0b9b904765e5c7590d0ff54a0d4055061140144c50ac8d78e7f149e30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8e181d00f8b265fa8906db42847f65f424eec53caedb83469692e55f37e669d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a4b7d2121c1a0b6ea0d6f91f0b6dfca2759729cfe994a2eb6a6667e6b4edd0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6713bc99135c617edeeaade68698ecdf33d333131a77de2650c51b3b2fb36ef9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5eb305150bdafd8cd17ff8f66d77a2997545fb016d4fc2403dd456d505ca0b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"01277e6b7cec6e52c5ed8c8a780cb7fa31f56958fa93a2a5627034febf8791e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec9fcf7e18d4cac0d461636f2eca5067beeaa5440b72ee39b4f1cde5931fe481\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"41c187b864990629cecc9d75d09c283380fe5f99f4b35a1ec1a6932fb112a785\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9d90b0ca5be53b16d790c3082127cc7315e4666ae929559754734de0429c8be\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"4b58c3803487d40cd3d7d9dc63790243a7353b4a1f8b9fd9ae2c009fc55d5d8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"26e65caa35770dcea82c3bc46eb21156e68b0f237e536d0654e8b461fea79765\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"443894938bd03a0c0dfb1a13d4e30954bc3b4aef05764e52dc4647fddd6751e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a8bde041ff87e0d7ca43c9b2cb552d0278f317b6db01967ac7e2b21386b4bd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3c3224d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1120d99d11b7594a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-w1-7966af\"]}],\"name\":\"c1e45b5496eca64cf0b773c04ff151ed5a4c0fb5e66b08193d6941fdb5aeadbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1945604402dab22a2bb92e179c6db3181c9764e9e4b91fc7ed2f36d11c05b72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f0ff2de1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9229ea41154ece8c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-distinct-2-w1-7966af\"]}],\"name\":\"d2cbb037fb718698317e136295b45ed06d5851b3e4dd7b69cc5d4284cfa0e31b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7966af"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:34.651Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-11ea30","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:27Z","generation":16,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5f9d701c-f599-44d0-846f-c2a7e5638d99\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:01Z"}],"name":"kuadrant-e2e-worker-w3-11ea30","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-11ea30","uid":"5f9d701c-f599-44d0-846f-c2a7e5638d99"}],"resourceVersion":"39809","uid":"d38a62c0-eb55-4f83-8e14-0f0bf8683fef"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"7e501414e2d808948b5eddaa7f3eb13b4877ce82957d2adebaf34a836c5ce444\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"fa4d09e98a2556f31180e48c4d9d80995168b68c25255a6617ff5fcec5af76d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"0e265f41f92f25d7807dc08172a944eaac20288601372a86e930f1345946c867\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"8ac3a676eccce06c93a581175c31eefc5da410e70579309c902ab32597ac5f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"099db7f703bc18e91019eee55e14ea78311b9e8c006a6d80178b4427969bbe2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"d167486b3a286179f2a574734132194356fcf46fe317fbc094da630cd968b226\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"59ce02df7fa04b0cc60f0ea6f22aa086b0f51340de5d6c38e7697282ade95583\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"4bd8db4d8fde3b6527fddb55cfec241fb481828efbf9384f3e0afc5cf1134067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"290bb37a29b764a67d6d28298d3b239bc4fa201a3722b25741fd74ee359cbca8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9be45ffa797958c72a1a39203c0b588ed452ee5d9d252c5df9004f63ed498d07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"ec7eda29a80355e79ad584ae112314a634ff966c3845c322adb4c7e30a115927\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"c946d75bac431574ecf87a5ba47e15caa560da872a09174b5036bf9f90c0ebd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"f7e700fd716c6572c297a61d035137c0a615240ceb902a6f605517e43cb3b51b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"024c8305fe118d0adf871619e5660208bb3382c0be529a41df5bf4c8b81e1a41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"02e591b14d1d911b248f6a57615920c164dc27ece5d75dc59e40f7c966017a86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"d6c7400827550730c2698f1fda6eab32d7ec1af6b7a019c1baa88a91919eae34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"48797135d73f587e843f75f61ae594882c62d94de2fad142f884d56b879787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"02778cc72718db248e0a19e01423d397465a06d51f9ccb69e6ebbfd24851cbf3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"5a8ec189257589d6eb2f8119a6e11a4ef922aa17b4e7f72784d8a4295931987b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"052c0658d6bef841b2dee7dfa4a1ac26c6104cb5e1b1b5ff1aa72d06ba0068aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5f33cfc21b53390e53f539550daf92821f9f9966396b0c1b8dffc81c79834ef3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"458fc67391ba189a51424b60a1833c6b3aac1b0d9a80b66bedc8a4bc0720cad4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e1263ac989787c1334fae799fad37ba5523a9c7fea8a3ced963e53e133ad05cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6634be4e1e349e075fa306fec4cc8d490cf8e09f34d63f6366662a1e5da80f59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"567cb1329c5ce873181f63aa9585b36cbdd31728ac0ff948e77b0038d7b0d639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"0cc742b9a303446dd9839593bb0c73439ebe804c6983e77f44562d58f11d5bf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"a1b7750bd5e7b7007476ebb57ac4209b2603ef7fba2a1dfc6830a5e86f72b5ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"533f5e66529af854e63da092f4998096cda919d44d8f250f0bee8346a83b561c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"60dc4f43d30a83a433e7a7c8ec26760512fe3b6834045fed257f83519e1010b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"397ec11215416691c2d8065d6f12e30fb013ec47cb386ea293533603ce3c74d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"ef2202f78c37e4bafa6be5121685839a838127cf98c583957df554688be0c13a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"61b462ba56beb0dd5c7a00db5ec898e65270993d6a30a37aa3f95c03740e42cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"6c33dffb6bfe6129da2f607bcaf300235c0c955b262eacfa84e45b66cbc52926\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"2831ae6371f9fcc08ab710fa949e52c2b1060e6692e034c9ac5336473e5e77c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c4e20feaa61d40b392e7c478b4878f1e369578fbfb2cdcbb2efa85fd0f42cb97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"7d11de4de428673bfe2ea958eeedb0f76eeeb719dbc4f94205024d3eb2d7a40d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e9bb7245f77cc45af3616db7e75d0905c9415f2cd7e6afb8e52b0903c5026fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"13f864bc48d9cb4c17311cc93c47e92f9e68f847b23fd1d989c1777bf12ecaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"ca4e394888dcdbbedd3071a78dacf7f7734b1637ce0022dd06d6c8d5db89a9d7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"3889c79f942fd5cd87050886fa73bf885ce15f36f46450a0b06680e03f0945e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"b51976e87d63318dca70c311ac6aa5346c87110ea930c83c8a7e6be98276cb68\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c042198a65c10a236d44152eb94d1c9ce282012744b5881818ac1c789776cc86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"064cd97002a8adf3f73a1c219c01ede3a466154324bf9c2d38ed802996fa1c93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"24055b76dd1b2b1074b2af17164520546ebf3584547ebb08222e57176c469cec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"0814649228590707265c0c5f4c05481a24e467825eb04f2cfe9b050cec451475\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"101523cf77328d6cc8d89b725b6358b5399ccbf12d0f5579fea9b252c21ed884\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6d1abdeb903d5c7409da81b9494cfb02588fce8bc268ce067c72281f3d2a3423\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"bd98fc62222edd4f185fb418cc21b343cd8fb7dadb018d20322923343b635a23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23582f77e306c43fbb9c186dd67dce35dbac27b48c88e55ce95f824242e5c070\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"4653b49e1df2d1ad70ac0cb086bd25a161a083daa5623830bf9c23a4d32d81d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d273924852db8aadf7dd4228e0f5a246820a4ddd31c0a3f987b9bee859fcb85f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"0f5c60927f2e0fa483306b2cb5bf209e25b290919908f47c32ecfb3f2d4ea741\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"b9f85a204cf99a8911948f83837caa2637e403dd000a62a8fc8effcaed065b7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5d80974a71752b455cbe1cf7f6745663ec15276dc551e435604c507fc7e1f824\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"8ad362d32578f96da0402397f19717a43bb6b422cc88ff4f9f1fcd9f9f051ded\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"996699b8fde3fe7b82d7fee633be4828868331af28fd31564d51eafe4050a887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"b6cd3cb3d8fe6c97811a84bcefeb660f7df86ee280fdb597ead5f618d1f1ff9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"50366813a245c7608d0499fe96aa6bcb2aa44c936eaff981254612745a5997bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"3287a60b3c10d53d6c1dc921ce50cc0e03b5652bb4969c0f98a7844bcd398280\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"a94425a593076417c83b2a40f12a8ae3c5c6b662ea65b8547feb3da20c01a7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"33b8c81c912fc47e6e2de04cb9f5de615ad2f5719d8c77a44640d718076dd61b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5cb8b3de52308e835c6dba6ef21bbbd5cdcc08e3a265f908db28054feb938acd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9ba49527c258b531f2ee72b000f546a9ebfd260a661984e53298846f5ebcce92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"ab28c9d732dd6eb9a5c664acc03cf1b527de0c2428670674b22dbf4902b0d28e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"797ae6033407ba51a6da601a47eb6f0aee25cffacff63d84822e2ead6e27cc17\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"e20a7320c56120af7dde4839033f5c4891aa05d7c9eac837d45775e251dd40bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"1cf89413c4e9b557bee9f2d1b259d19dd3bdd194fa97af466a817747d338f22c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"bceae3e6581f689850ae06da68761e7a9701cc2befc42b5db23b5de587eaa948\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6820726e004d8eb5c0fdc5bf7ceb2e9f78a4c533b6cd4ca0e024f6f2969a5489\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"3740f1f42e103769f8eb7f75f85c2046536e7cd0ead852ec9eaacc5bb6b1828c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"92a48cb8cba483dd253a3593c7e275206a0068f8bf2edbe9cc778c48036b80eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"dba8d67f8dc748e736bddfde9787dcd9f2abc4734b33904c161dad62fd54eb51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23e5d03604f396cf0f7722326bd1ab80ece27d6aa17559855854e8ee3826a9df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"f69075aec72ac5316b8ba068397d9bdf8b100ff775c12f10dc7c4a33141e4e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"39dd8dd5a8484f7acdaf3dc3a0c56c3398c524eb4109939c214eb63699129f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"28bcc6325fdd4b99a4f30057dc26255507ed669f632fedbfe422e47bc4af05f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"816c0d35beb47f6d90c29c30bffa876aa137bb36f61871cfa8a2aec40877b53e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b5cc0bb9c7d9964759f7998f9585e1e621c82d9037273b378114680ff9987fd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d6fc562ce8225bbeaea0c1a8d900c397a0f6ffdd32d289781d766cd6717275e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"222e4bc4c432b58101d67be0f5d1761ac686be63bd1cd2368af1e6ccd4ab2af1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a89daaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d6aa0727efc2abd1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-w3-11ea30\"]}],\"name\":\"e76915430709bf5feb36050c9e422151d907c366bbb29f3971af1c955b350a6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__759e90b5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cbb37728d1c841a1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-distinct-2-w3-11ea30\"]}],\"name\":\"fa6dfe6a45bf0083d1bbba31cc4b6ae0995579a3592c3a4aee778ecd3ef10c7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-11ea30"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:35.080Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"e1296ee5-2b89-41b4-b69b-7d65a409ebfe","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w1-7966af\" not found"}
{"level":"error","ts":"2026-11-04T00:19:35.264Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"7e8db9f3-3d01-4280-a3a4-56825938c588","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:35.323Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:35.384Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:35.629Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"f4aed144-7557-4ba6-a328-dec433772b47","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:35.944Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"4a1a5871-1392-47e1-8532-59970d4c665d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w3-11ea30\" not found"}
{"level":"error","ts":"2026-11-04T00:19:36.329Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w1-7966af-kserve-route","namespace":"e2e-models-e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w1-7966af-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:36.576Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w1-7966af-kserve-route","namespace":"e2e-models-e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w1-7966af-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:19:36.582Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-1c8dd4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:19:46.861Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","HTTPRoute","EnvoyFilter","ConfigMap","Limitador","Gateway"],"eventTypes":{"create":1,"delete":2,"update":13}}
{"level":"info","ts":"2026-11-04T00:19:47.057Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:48.240Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:19:48.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:19:48.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:51.352Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:19:51.356Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:51.356Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:51.356Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:51.362Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:19:51.368Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:19:51.557Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:54.626Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:19:54.626Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:19:56.700Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1,"delete":2}}
{"level":"info","ts":"2026-11-04T00:20:01.261Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:01.322Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:20:01.330Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:01.330Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:20:01.385Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:20:01.385Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:20:01.940Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-de0ea2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"6e7eb8f6-4c81-49df-885a-1cfd92034b41\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:01Z"}],"name":"kuadrant-e2e-worker-w4-de0ea2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-de0ea2","uid":"6e7eb8f6-4c81-49df-885a-1cfd92034b41"}],"resourceVersion":"39791","uid":"ad417c34-a43f-49c3-8386-dfcd19d97287"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"8f41f5d27f92196508ddee2fc47e51daf5af5c4825a7e8591ede0800be949fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7a4e12ba594de064264e5a79bafadfb910f6fe0c5c088cc1d86aa478feff909\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"545e35b30c59a1aa62ea994b7a5be31f8d3760ca10aeb1ba456d4eea87cf7a6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"a4133ad72b872fc03206a842894304ad17b775369b97a617c5b595bdc943e826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"771078d889ef85b81946eff0b2ff32fbabcda38cbb208fa37bb96509f7d979a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"bba5991046822f1b6e0758327a2491b9658a798d2b607b2a7144f024f0067676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"6d451581ca6171a655cb504496641e173bb76b72741c6c02eaed94083a536735\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"46cfece21c467f625b03ba5a104af0b1e8d4a213c5695ef30a112544f1c16cbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9d157bb2d1741f38e7e5854412ecaf7c47f4b489927c97cca666d33d1bb4d834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"a6089be44340b73e309196db9a8c89f042bf2d2570f1e88b8378d364827acdbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"d186d8e5e42a867e2a08face337b9772aeae6ba493c896ca867692f02c4456e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"8d1e7b487515ecba92117549552071598f9233e149b32fc4eb13567225116a07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"68a9c4eb18e71677a594352b1b7ad0325a4c685212ace060db3b90da668c6f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"5cd2749f5fa499321c3a48c9e432951a046807348668fc35fed27b72ac6db3cf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"9d55be3daa24118dde3ad2d28e0c6b48c00dd4df682a4745fb2c1e69a0bb735c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d5d96025b93f14012073fc9c61dbf91db95fa9ca2b726ddb91f601e538620862\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"06e46d8eb2da8005de0d157a8845a587567d7612ef6f79fc810ddaf2f78d6bb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"66272d32af643987684100422c0268e207c651a098012b0f2f6c77f68bc6d25f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"84d595c1af2ff8ed9ca0194212a4eeb97f3de15fbf7e225e4c6eb56d5a39f8e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"c13145cd6f1056971233d0e758c11ce8cee133a64eb3cf6a02b122d5a29a71a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"31e47065c52fb96c2470ed21a3d45c533ef5c080afe214081ff5637fa2b0d420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1b9a9d0030ed877e95dea36c3d55d7589cb8b6b826be9455de9bcdccb31c4a39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7db200bfe44cc9433850257d064b4edb5240dd6951e2251e271d79ce2599c45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"042db8e6145979020b4aa2ccc468918dcb1f32d03a1880a86a855cf8560eb16f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"5c91323526e4e1197474b1874d1ec0a636c457a84e2013e3688214b3c9f40292\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"56ff390a2f15a60052acfb6c577c0d99916ec6f8ec0c500a95983e8cd3ea840a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"26bea37b48ab2ee00f259c3b8c9bc4c47b26a86a798c02dc31f2843e47829ca7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"19013eb61834602135d4d3c8ffee368d3060b9b63fc5f9bf0951d431b8c38fdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"3b814cb972103fb740b36a5d13d0e90ab61a2243933f933f775c42677c1a5d85\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e7c8f0c364705957418c58fc49a204d16bc88650633ba572edfd632ab77f5666\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"91cab405f0636396c7771c6dc75f806c2ca022fb0848ae3c2fcbb33e22a339ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"67532e0078356f799dfcf346f3e77095d0c624d2d10cdeaa6e88f469fbb87049\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1b04bb6432aa7ede0fec0fc20a68d9446f453e5c05a3adfd45bf17a6f8b9ebc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d0d9929f02171b1ab4c86941d9f44cb58b54eeb19d2f221229eb30f01bcf7375\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"566ec84294cde50603c3dfa36bdf2a31651f5466d00e709b76f896a26cdc6f50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"6bf0b16aa8962b07d84f7048f7b90a0b18983bd80e9edb53eef17bed17344e99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"12b5dd9ded539680a4677101fbb814ed65f93d791dfecc06a4e34ac1ca666285\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3feb12b2847f536be51d0b1e92294157bff9383e20f2265f92e3ea76cb048d9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9b267730031d7c70062f248c5d4811c04b382ca0287062b64928d46b92989d20\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"fd11e09603fe10b92e5b13701b94b1bc51bd77fefaef648e1161701b5fa58e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"68bd4c49aaa83b70448e00df2203ce7ce94bfe9c263e924f642ee7ca2732c5e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"f72767414d30bcfd4e1eb5788ae3b97e09949d30d08ca78756af19a21889315d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"685672fdf62a49b437cb02b0a5cf31117061b1cb305120627a24d822b87448b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"28b61973b7f554ada23df8f2adbcef9c3140a267f58ebf2ee8fb91ca7b72c4a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dac478a38580f45da71c649418701234a58fe64e526cb6afb7481ba444836b2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"36b0f5aa2c414392caa7ffd3bb635d11e950c904103befcfeb425d09f5b9dd48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"90c38ac2efd8fc638edcb5f7c8693ef7a3280fbb60b050b3849a607a39eaf69d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"03f1f356a7d76e767be8c0f275a64f6b98f09a8f3d04640561ef4c3f580d2783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"4402031351082e527488b2a5cccf7d68722dece1fa01370d5c21333ca6505522\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"b9c11f37fe72e97b7a55dae48d999a758e39f367ad7a116d7c28ae2380778fe1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1fae005cfbffbe4e3aaf50dbb8dd3b5a9f584045e1475c7738a315467ec67d5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"135dd5eacaaaeb159be4c9871fe73af3bfd928f5de1be32e147f296965866b96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"336d069594861bb5e759f874cb7b2f97e4c07a0dcd6170a429970f5f2d53ac0b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dfc32b1869457c56bed8d097b7c0a22a2a0b12e527f2acb8733ab9067d057c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e25322c24d98be7252f7c79cda0327987ee6ee4733d332ed5901e1b273397c89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"00bc5328f6973fb2115cb694774124ef334eba1a1cfc7badbab358850a407a44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"1f9f53047b22c1c17c09acdb0fd9c17eb0638398ecc1a9a37a86b01d811cccb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"96d4f3037b42b8b4dbb2b4c60ec972ab8af4ae9746f33d3238fb10f28f178b9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"310e1acfd0057c6e83529a4c7d8365e210e81104c28ddd0e12bf7c27c4f96a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"78c96b65770748aed921a19b6a2bd36cc8321c0a7dec5651a52e25bab7ad2164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dfcdd2ad233477f91e46e790091a8a25cccde3e540e5dfee8a882e70548b396d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"32a037705f978b303327717e1c0ec5e2335c0b26c10797f521b5135cf6a2453a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e6a99dc788b835aacddb6627c89f73143a475188279769039fa67efd06d375ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9960c39f056ac6bfdf36a15fd9c1fa7c853b27ad278ebc44f7ec6e94d68172d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"7287734b84ceef6341393a90e3ed4982016519f2ef7f9218e0807c5b41fe5f8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"45872a4dc74f3d9c8887e6e6522fcc3828da98c8175226158ad7d1e0d3a30127\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"688f84a7dff8577d0e7ac9a7d4ec36ff7dbdda50d779bc6b57d6aae8ce8b2fa7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"435ffa54404a9fbb884e542d138a68cfb6613f929fac5c1d075c32a78366f2c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"41543e9b40d595358566e7bb5bcbb2fccbbbe2135adcd30f456cbd888d802a5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"4aa7d5ab26c862da3f59d51848309ebfd14dd317c39eeefa3ea8a80838fbb716\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"80cec2e610c1806df05551724b800f012f0c084c1813547c1bbd670985b653f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"74df5489e7dfa47ee79eee83e342918f6531e925cfe1a798956b35da601d884d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"ceac94fca2ae9ea5cc47f3df0ec9d6a10b6251c722a213562fa646ea167dcdce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e619c29e635edd15be7867ccd71c115af280811a435be9acf9042fe6ce2369a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"836cd1aaeda4d6b267aa83969a7f76f361d3884106e3fe9a1a411ebc103c733b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"58317c757c8a458d1a8d6d5b7d8a3528d73c19d945347d61d3167c58a9f2abf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"811ca47fdaa1feef5760290388150e142b3763ef459a60d86cb3e223c6af9a2e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"484761bfa30c42040a68a552fd37e9c6794f6d1979ee07beb44e5d6b81c5f2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"c98397041d5e3535484e38692edcddb66bc94af55a8aefe7b372827b5b9a3658\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"df7b3104a100478ba86ef3efa2a83b687d49ec85b07c62e635a293b710028281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__64096bb6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ecb301e57ad28f59\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-distinct-w4-de0ea2\"]}],\"name\":\"3fe8aaa75098b89c44ca3fe5a5cfc62dfa76bcc518cd59e8843f2e901b0a131d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"cfa45a246c21e687ad88a5b47e3484a2e94f500826f168a1b20a49a1094bc73c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-de0ea2"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:02.104Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-11ea30","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:27Z","generation":17,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5f9d701c-f599-44d0-846f-c2a7e5638d99\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:27Z"}],"name":"kuadrant-e2e-worker-w3-11ea30","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-11ea30","uid":"5f9d701c-f599-44d0-846f-c2a7e5638d99"}],"resourceVersion":"40592","uid":"d38a62c0-eb55-4f83-8e14-0f0bf8683fef"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"7e501414e2d808948b5eddaa7f3eb13b4877ce82957d2adebaf34a836c5ce444\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"fa4d09e98a2556f31180e48c4d9d80995168b68c25255a6617ff5fcec5af76d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0e265f41f92f25d7807dc08172a944eaac20288601372a86e930f1345946c867\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"8ac3a676eccce06c93a581175c31eefc5da410e70579309c902ab32597ac5f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"099db7f703bc18e91019eee55e14ea78311b9e8c006a6d80178b4427969bbe2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"d167486b3a286179f2a574734132194356fcf46fe317fbc094da630cd968b226\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"59ce02df7fa04b0cc60f0ea6f22aa086b0f51340de5d6c38e7697282ade95583\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"4bd8db4d8fde3b6527fddb55cfec241fb481828efbf9384f3e0afc5cf1134067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"290bb37a29b764a67d6d28298d3b239bc4fa201a3722b25741fd74ee359cbca8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9be45ffa797958c72a1a39203c0b588ed452ee5d9d252c5df9004f63ed498d07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ec7eda29a80355e79ad584ae112314a634ff966c3845c322adb4c7e30a115927\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"c946d75bac431574ecf87a5ba47e15caa560da872a09174b5036bf9f90c0ebd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"f7e700fd716c6572c297a61d035137c0a615240ceb902a6f605517e43cb3b51b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"024c8305fe118d0adf871619e5660208bb3382c0be529a41df5bf4c8b81e1a41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"02e591b14d1d911b248f6a57615920c164dc27ece5d75dc59e40f7c966017a86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"d6c7400827550730c2698f1fda6eab32d7ec1af6b7a019c1baa88a91919eae34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"48797135d73f587e843f75f61ae594882c62d94de2fad142f884d56b879787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"02778cc72718db248e0a19e01423d397465a06d51f9ccb69e6ebbfd24851cbf3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"5a8ec189257589d6eb2f8119a6e11a4ef922aa17b4e7f72784d8a4295931987b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"052c0658d6bef841b2dee7dfa4a1ac26c6104cb5e1b1b5ff1aa72d06ba0068aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5f33cfc21b53390e53f539550daf92821f9f9966396b0c1b8dffc81c79834ef3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"458fc67391ba189a51424b60a1833c6b3aac1b0d9a80b66bedc8a4bc0720cad4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e1263ac989787c1334fae799fad37ba5523a9c7fea8a3ced963e53e133ad05cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6634be4e1e349e075fa306fec4cc8d490cf8e09f34d63f6366662a1e5da80f59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"567cb1329c5ce873181f63aa9585b36cbdd31728ac0ff948e77b0038d7b0d639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0cc742b9a303446dd9839593bb0c73439ebe804c6983e77f44562d58f11d5bf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"a1b7750bd5e7b7007476ebb57ac4209b2603ef7fba2a1dfc6830a5e86f72b5ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"533f5e66529af854e63da092f4998096cda919d44d8f250f0bee8346a83b561c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"60dc4f43d30a83a433e7a7c8ec26760512fe3b6834045fed257f83519e1010b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"397ec11215416691c2d8065d6f12e30fb013ec47cb386ea293533603ce3c74d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ef2202f78c37e4bafa6be5121685839a838127cf98c583957df554688be0c13a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"61b462ba56beb0dd5c7a00db5ec898e65270993d6a30a37aa3f95c03740e42cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"6c33dffb6bfe6129da2f607bcaf300235c0c955b262eacfa84e45b66cbc52926\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"2831ae6371f9fcc08ab710fa949e52c2b1060e6692e034c9ac5336473e5e77c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c4e20feaa61d40b392e7c478b4878f1e369578fbfb2cdcbb2efa85fd0f42cb97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"7d11de4de428673bfe2ea958eeedb0f76eeeb719dbc4f94205024d3eb2d7a40d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e9bb7245f77cc45af3616db7e75d0905c9415f2cd7e6afb8e52b0903c5026fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"13f864bc48d9cb4c17311cc93c47e92f9e68f847b23fd1d989c1777bf12ecaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"ca4e394888dcdbbedd3071a78dacf7f7734b1637ce0022dd06d6c8d5db89a9d7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3889c79f942fd5cd87050886fa73bf885ce15f36f46450a0b06680e03f0945e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b51976e87d63318dca70c311ac6aa5346c87110ea930c83c8a7e6be98276cb68\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c042198a65c10a236d44152eb94d1c9ce282012744b5881818ac1c789776cc86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"064cd97002a8adf3f73a1c219c01ede3a466154324bf9c2d38ed802996fa1c93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"24055b76dd1b2b1074b2af17164520546ebf3584547ebb08222e57176c469cec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"0814649228590707265c0c5f4c05481a24e467825eb04f2cfe9b050cec451475\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"101523cf77328d6cc8d89b725b6358b5399ccbf12d0f5579fea9b252c21ed884\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6d1abdeb903d5c7409da81b9494cfb02588fce8bc268ce067c72281f3d2a3423\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bd98fc62222edd4f185fb418cc21b343cd8fb7dadb018d20322923343b635a23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23582f77e306c43fbb9c186dd67dce35dbac27b48c88e55ce95f824242e5c070\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"4653b49e1df2d1ad70ac0cb086bd25a161a083daa5623830bf9c23a4d32d81d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d273924852db8aadf7dd4228e0f5a246820a4ddd31c0a3f987b9bee859fcb85f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0f5c60927f2e0fa483306b2cb5bf209e25b290919908f47c32ecfb3f2d4ea741\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b9f85a204cf99a8911948f83837caa2637e403dd000a62a8fc8effcaed065b7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5d80974a71752b455cbe1cf7f6745663ec15276dc551e435604c507fc7e1f824\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"8ad362d32578f96da0402397f19717a43bb6b422cc88ff4f9f1fcd9f9f051ded\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"996699b8fde3fe7b82d7fee633be4828868331af28fd31564d51eafe4050a887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"b6cd3cb3d8fe6c97811a84bcefeb660f7df86ee280fdb597ead5f618d1f1ff9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"50366813a245c7608d0499fe96aa6bcb2aa44c936eaff981254612745a5997bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"3287a60b3c10d53d6c1dc921ce50cc0e03b5652bb4969c0f98a7844bcd398280\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"a94425a593076417c83b2a40f12a8ae3c5c6b662ea65b8547feb3da20c01a7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"33b8c81c912fc47e6e2de04cb9f5de615ad2f5719d8c77a44640d718076dd61b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5cb8b3de52308e835c6dba6ef21bbbd5cdcc08e3a265f908db28054feb938acd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9ba49527c258b531f2ee72b000f546a9ebfd260a661984e53298846f5ebcce92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ab28c9d732dd6eb9a5c664acc03cf1b527de0c2428670674b22dbf4902b0d28e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"797ae6033407ba51a6da601a47eb6f0aee25cffacff63d84822e2ead6e27cc17\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e20a7320c56120af7dde4839033f5c4891aa05d7c9eac837d45775e251dd40bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"1cf89413c4e9b557bee9f2d1b259d19dd3bdd194fa97af466a817747d338f22c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bceae3e6581f689850ae06da68761e7a9701cc2befc42b5db23b5de587eaa948\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6820726e004d8eb5c0fdc5bf7ceb2e9f78a4c533b6cd4ca0e024f6f2969a5489\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3740f1f42e103769f8eb7f75f85c2046536e7cd0ead852ec9eaacc5bb6b1828c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"92a48cb8cba483dd253a3593c7e275206a0068f8bf2edbe9cc778c48036b80eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"dba8d67f8dc748e736bddfde9787dcd9f2abc4734b33904c161dad62fd54eb51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23e5d03604f396cf0f7722326bd1ab80ece27d6aa17559855854e8ee3826a9df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"f69075aec72ac5316b8ba068397d9bdf8b100ff775c12f10dc7c4a33141e4e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"39dd8dd5a8484f7acdaf3dc3a0c56c3398c524eb4109939c214eb63699129f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"28bcc6325fdd4b99a4f30057dc26255507ed669f632fedbfe422e47bc4af05f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"816c0d35beb47f6d90c29c30bffa876aa137bb36f61871cfa8a2aec40877b53e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b5cc0bb9c7d9964759f7998f9585e1e621c82d9037273b378114680ff9987fd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d6fc562ce8225bbeaea0c1a8d900c397a0f6ffdd32d289781d766cd6717275e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"222e4bc4c432b58101d67be0f5d1761ac686be63bd1cd2368af1e6ccd4ab2af1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e76915430709bf5feb36050c9e422151d907c366bbb29f3971af1c955b350a6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"fa6dfe6a45bf0083d1bbba31cc4b6ae0995579a3592c3a4aee778ecd3ef10c7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-11ea30"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:02.276Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-1c8dd4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:55Z","generation":10,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"1022736a-9ea6-46d7-9666-09e1fa7f216f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:01Z"}],"name":"kuadrant-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-1c8dd4","uid":"1022736a-9ea6-46d7-9666-09e1fa7f216f"}],"resourceVersion":"39778","uid":"c24c7f5a-e883-441b-9157-1c12216ad398"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d722f2773a064322e4f94bdd5518f8f21a17a4d3e9be728f24cfb4fd345e4e9a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"fe2d1bb96a8aaf1ce9dcb9486703a202aee72f3d53ae431bd7231723e5bd74fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"98975d104850538a792ccd19e2cc94afc3ee0ae0c91994978b98ef785cbde53d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"e044ebc76d11ae8f0f4842359b3802e3110f11079391259eeb5fc8dcd8fe98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"872c935eb7627fa9e9b54e9b64feca8fcf4db2fc6263c2ad9182de3020414f41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c16aef0a553732620ab3d17553727fd98cffa1f02446927a150f00d70e52c05a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"8a830d301ff5a71a133f2e5920a029e3ec3236b99ca7c335ce75edb2f135cd0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"8eba5c5e5bca470bce8d31262b89d1a43c350d64321474cb1389e98cce8f81c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"18618e03f7ceb171bbfc4325ef3055eae56f1ab466480d27270950382def7ee6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7e18ce43d7153957576261ea6bd1838cbd27e9221d7441a51d3b82467e783035\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"72ff7a0549b7f2b4006712493670cf5bcb7f7c53bc5317086464e575e8708f51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"55e881ef18d3f986c22031330e1ac075317ff8c7a8c7ff4fb15e6284e746f1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"deaeb61d09ab93f9f03227f87c16291cbf69018e9b985f45af50fd6bac96a4f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"498e7720200a468d4042e9bd9edeeb8ffed0aad4fe195cb3de0aaa2e7b1f7aa9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5557f0c59061b9b2fd5291c9ae974f8090764d56f8782ad1be7d9aa685dd069c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f2099f4d971741a51df3897453c41156341ec88be3551211a725467a0adbfd02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7a86223ba61568a2770448435689d6367383b116887b4e0f962f92d21f0d767b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"8ebb2e74c2ea0f835197bd8ac2f8e5e6aef50a2f05b7cab55e49ad3d0430e3ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"40baba532e9d879d798fe30bfe9c0d11138364343b9474190f8aad3b7b1f6915\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"dd26f053dbf977b8b193971505e36b6a07a706e3ed9c8e63c379ac2293d82dc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"06e7cf7c58cdf904f2014d394fc10aae12621f7f0d3ebe5dd26256424fc624be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2e73311a2a5aabc79b44092dbee50596338ae09ffb74ee1ec20dbf97865ad4a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"a2c40926c96848a1f64e2f8432e7be0de6c63c281170eedd68453cf218b53470\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"eb903fb2f395cd1e0cd0ece3e9569e47debc23b27198f10c2c299239c6fbc66e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f43c5685eb05b429ea9501f8435e99a510dded670763fd887490394976e47203\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"2f7853168e97bf4316ce3f174e5e8f601ff9b2184251eb8a5ff8c571e9117ad6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"07c8be951648c49fa94df5e261fd72b0d6a55d6d12d56aa4f6195a28d45ad73f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"2e484b0f507b4aef3f88f2d59b9740828b5202265477def64972b5a1e9821558\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c54fca81c42e570a25905b3c6c7d0a776654133d335a9e76b5c542fdd08244f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"88bfc8c650c883186ac394d93461aaf7a113b8086749088f88121f96d71bc350\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"b4c9c4ef3b7ed99d874118d7d71fab084fd2693839924bcb9390472e1aa57efb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"6761fc9095f50680da68f052e7bb745937e12a7fe6c0d00779b9df73c6ec1407\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"107c4fd088c79ed8fec71659768d87991ca27c12f0933f5856b0da18ddfa028e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"56d39e4652a0a101893e398463abb10dc9823cfd47192cabdd002e4ee6f525d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40da9b1442f8c865c6738c60853d840efd8a82bd368270d0d17d96b7ed7c0efc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cbca1d8ed9ab62026715b9dd0f4379e9ed34062cb0c5ff54adae4211b08f6fb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f6f7631a002f287686d1a42dfe6abf8ac2d9bbb36ba7b84b485fd82541e3675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7ab78aa758093de3cb3dfc32bc45f25e16886a2fc5e1820b9d810fcd1d1bb21a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd316c1011be2ba1e92977697277c74807ad2d7d8863195c9ce94350cab7ff36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fac652fd9b1dc98ff92020b3cf0cdf4d301a3c4bc17712267db67f99723e5918\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b46d7a290c8c6c1a20e45d9a689facdaf1135fae0cc244ef0623792814525c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"d30fac8f2fb796899bcd15432be29e9913ef74cc833b8fa9172fcb3032a894b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9b799c155c82bfacede075ce6f970c750ea8dde484ba3caa7b2a882b6227e2cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3664590b8723decda0f1deb0a6fac69e835aa6deb0d87841a8cb2078ce9eadbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08334bcfff931cd495c365f3735e3de949e766138a9b03ce39abc75f5f665541\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2987e31c5c3334f42edfdccb340b13f64ecb2e327c821bfe532cd3a9731cc0de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdd5f218bb1de67fdb4c5509a7e18511041e8821a02fa2e3f9adebc6b4874aa7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"4461e5dfd48fdc8eb0f2fa58b1fb467a8842997144340c53ec30b456d0c32819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa569c37ed600d105f8a2125beaf07c522497f53f11cf3099fd4e2348d46ec2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"304090cf99dcb2b139a39b24dbe0fc67b96e79e86d892ceecdd012c0fb5f51de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1eac59fc45114f2ce4deec1fdcf1c3fe2eb41f7adeda4c7ae7cfdc04fc65426\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"fa203dbd971b487b7333113774122af19d7dde397f3d8844cd2147b55778de4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1572ae59c6a795c338fb2bb2c6841973fa92ed1105168214da68a898a643cb43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"b9e1423918d69a0383c5a37f7b69c123793f9166183f73b9559bb7b0265193f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2e2ba829c80c6b7702bd26121920e6e561d643d373b81e6f19ca5d51bbdd17df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5e8ecb70760bbad248a21757c03c8916dfdcee1f2053ea966f59381c808149b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddca80e7dce3248bcb6173da3eae450a269cc516f706eef1eba2ea35c4a2688e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"abb79379262035a146f66aac08b02cff323165a37bacd7829b856522aca43887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaa1b2a1054fb53c8ff038dac01c6267251d8afd3e74e84cdc91d24302a4e4de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"88690102e83c0534cc670fe54962275c7b96e72ac65fdc7d75bd0787be36cd80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c93ae5417465b5195f2f67ba8d1b25b4900246774df9fe2f5df40220efbfcc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"067c2408bbf439d968882014e393801f8ee59b42a180a1e2f88edc16f1c380dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bea74a5e79312d86a7437b9b9107c9aa5f686e6d9a4148db2aa2d554135a8305\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f77376be4767c7f0d7b4cb876abc7c786544b05ffbf59e71c40ed738c0f23c8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7462618ce57719ee474fcda0c0f2b0a69b4be5f4fe22fb5a71662eace7c04552\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"610d27fbf7e70d25ca269c5f549054a67d35af30b7dd4fc784312db9cce4df23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6946f2258b914d5a4a901db43a29f69619f5914c83ce7f2253a5b15576a4bd1f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"982fadfb9a84692178e8203c6a490f473ab81889e372e8cb919c238a3141e193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e868ca29b1c1c2374441d92e4aaa1c6171e27635e90525412ba8c4bca24b59a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"585e58644bf42565979749c76320b49179d7aaafbcea3a586381c94c8ae91af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72285f03fe9b4e8619a5e1e3b78afb7d6a91af4b4ad126e8fe429adfa311785a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e39730b3bb03d3feaa6cedd97e009c3803c3c1e93b390e1f16359d23d2d4afa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f156043d80ae9202ec913856fc2ce218cc43b4082bacaa75b01f9a373ec0e57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"c8d3989af6b7881a200d5fae40430de3438a8a4fb910666ffb0c0fa3815ea2ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7a4155a07f6048125b423c1b6d272d77ea9bc24d7c897587107eb429ab2ab7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2ce83896170df3c28b859812d6e5a676644dc9aa0c347553cf19f4acaa03543e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07613ec6104cadec59fd785bcb990b5a38ea5343d6c74a38a40fad81b771b119\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"3dcf1f4a73977a1dad8f77938e6cb8b3e54b2d46359776c5af2e11edfab95c49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"250065119d3baa7879803f41eb65b32f6614a6a3f80fb2d03ecce0cc0e65ddef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5e826c20dd5710a6b7e7446075da02d64e4b09bc44ef94e039edb05484bfcc06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf1e7d0ef8559d974a1323420a3d396a5f1224745470bf01e5f84f9e90671cc6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7770ced6938234629c72124c64149fa0906e6875d3620e7f2a0b2b905a384722\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc98d55a5fcde068535f2fece4eb03bb9f733db252068dec8c93dd086be793a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"b51ab026204b7bae0773436ce72577fb27ecffcc646a0f6882afb62ede8abe6c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af5e6bdb6b32a2da886759932798d61fc00c2948cb89ef707a8c77de30dfbfc9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"27878634d95404360b653257f3b03d7fb2006ecd6ce2978b68a1d115150e59fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca78ecd27c5cb0159528b820a7be7092275b9c5abdc62b572dedb7e627141373\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fde88c7e29be0745a9e8705f9903954fa2823d8ad2133a839db3d5ed96adcfb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4de96f4310ada6e084741030e975dd1f38f92b2a8c4006206161b34924f621d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"025285dc38f097b725e71fec4cf5f71217b8dffd5d74f733fc8154e122b6034c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ccf4f502d8f42eaace6b37e237896d6658342da096b8598da2567e1a97cd7a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"f53d7752e5e8872a28aaf4951c5bb99e52039e2d080871c4e28011c2328f2109\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0442670ca837fcdf5b5b65185966e09a927dc7aa7c0ef0689658297531f91c7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"55f4c111860bc29246c5f77e3c4e7d48647a53865883b40ae1e8515b9d02d7e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"126b28f315255821a23330f516efbe14a895b48f838ed4577489e7c3a7e289df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"4589e1b797c1c898e5079ae6dc96acd6d38d4718919b2f08c1eb7206448b4ab2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"496e1bf7f5641b54d2165111905fa143e0caac6fab14aa60c4c4ba36d8450772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c345c923befde091471bab05f155033e00973c1f4322f2d695969ef630cdaa8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6fcf011ad844ec14108de764b81b128fdb18fca9ddf8aba8087b147dd4f5bfdb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e36e9ef49d9eee750dd3bdaf13f7427ea50658d943798c5936bd4022a828fe2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"667d3a93329c566724f271b9c13e60b7d3bdba5a17c57765887854900434892b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"1826d28a53942692d22546698b1e127e9f6cf018551f0976553bfa20e5361993\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b79bb31b42338d4a406a8314ccd79dd125fccbb0f1321cba1e6e2a76810ca65c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"505c2b2acb351d14b73deb47ddc79ae294a4d0b7167b7f38f6dba24dbf4019a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb8bac264d82224c8d8c821d533af6243655e8d48c8764ba43c2d9a52e624ff8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c1b45264e1ceea9ba7c7c57d22e4cee07e3c66a3f40f55a0fb2a02229878d689\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2a39cb466936ed344ff5b35e07f242e326fab27306803cb683ba6df545a69c4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"a0ffb3b8c11614dc5ff46348cca0e094c00ec437821e91a13a57b7b7a5195acc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2319eed8b4ef51b4414ccdc8857bd036554e70a55cfe750dc216906486952a53\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2eb301e5e4984be512b687e16a81a3a6a6ff2d80d4a23d38db2a15f8d2c5e23d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aeb0450fc0ede1b61e5bb1612230e6cc8cc7b2c66ff5bd0847078f3b01b444a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3224b08ceb25452655701219f7d2126150d377f4f0fcc7a7353e4e15cca11871\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8542b97537c28e07d57bd0a9c9474f31b46be9996c4e9bfc3475585960e95017\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7af45dbed1145cbefae25036f9b976a4ba04ff1bd6d65257c779e505c08e7664\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206405c4fb067243fdbd7964f80dd6bb48a9e3ce2c5335c82aca73c228e43441\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cae718fdd03b8a36914e865ce59f9f9820ec9eef12d4d0c9c6228b86a7fca262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"88058e8c9de15d7da1fea7024cba67237bdea366968f5e13ad3e9c0be8b34c46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"d78e0b7b2fff91bae4004dc0f09025510ecd9eb4f6ceef5f1004705995ee6e82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2028771388f8279a0773be1740d35e06fd4143c31788bceed01bae9e8689e4e8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cb1bb94e9eb8722108b82378027c9a6cc6927392f2679669c7127da5b93d7f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45b69d0a2617fdc908edabde94957a37df9bab4d7c8d1f0da2d3348571dfe24a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"58271f39ba379295948cabb3698a9f3eb43a28dfe7bfe008e8ed6a9586432164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8a5f0bed0ea44e46c7ffd9439a1c95a25744aaa30796c29dedf2f67e0718e99\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3588a32f4036d13fb6b19114219c46cf512773bda9a64cb8254668ce2f84bbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67f92abfa1830b39b11b6fba47fa111e608ce1ecaf6453884763534c3d3fb793\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d43defb9cd59af289b9dfd9879f86908b2485fde88b5f2ad80ad79a573e5025c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a38a3aae7b31ec5ea9420576df60ef9fc1ea0e252b9d3d96184215ce79b3226\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"de97507b575cf8eeb6ed5f8969e3e733c20f8d71018e39890aa1f57e803f4cf2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3e3834d3118318c51dffc32390603e36934595c5092fba7c22201192be37f07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"dea8f45890cf588ef4a93ce717a6523504e30c4b7c1cf6c22aaf2399d55c00f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce72d6ea777e1d3f6b60618a850b52e098222a66964c7963514746d1d3dfe27\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"e8ccecc36ea50ab185e2cb24105f0d05a0d27ca156cd2483b712a076fcbf67d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-1c8dd4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:02.435Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7966af","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:11:32Z","generation":13,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3339de9d-533d-4f55-91d0-b84170f6b978\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:26Z"}],"name":"kuadrant-e2e-worker-w1-7966af","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7966af","uid":"3339de9d-533d-4f55-91d0-b84170f6b978"}],"resourceVersion":"40567","uid":"84d3cf1b-9529-4eec-8e08-c57c140360fb"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"8f671fe7fb5f95b66e479125c8b19fd0217da23efe9684323c945741670436f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7944c68a19f214e073476795452b68fc9f5c529621681ea36203a49113e60ea4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"44a37e2c7d3d57249bc83945c3dceef1cc1b386a13ea420490c3c498650356fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"55f6b7654a8478c1590ad97fd880538c4663712c8b5f9f65f533de7758a22fa5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"6c0eea8cb78db6808b765b480760119a06ee79ae8167f8d90831e4cb281cb055\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"4b8eaf23f03d065c5b264b0666f537c2a1f3ae7fc4800d616579730b9f10453e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"fee03f39e20b1fa1cbdef880cfa00e34a91c55cca98dd062d1232a8c504a2a8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"a922303cec22f7f675536511ea62683fd98789b99e59a1c67809c786530aae41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"53857e7b46c67135c4eea145b67cf842f3113bae4858e449b4d0bd56eef71c2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3ae896f044fa430bcc80634f8b4159dd74a9f5a95c90c59479a5dd22d0c0a777\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2cb7e6e19fbc4c9c857a59ce3a675c11eef097c10a58fd1655b73542355afa67\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"78ffc0a3105eab5a7fae567e63533e82ce53434ea80bc50692e1945291378838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"b9aad3b0a062c993c24c9d12afd48a040a60b2da90cb386f3c22af54c8c885b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"1dc52073af256dbc9bb4be8aaa767206edbfe0aa08db683e79d9c67836f18746\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c08b916a799c7312d7c549cad9123478e41f46f5b311664828e815118232009c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"9ca70c30491e45dd972040fc2132bc2d62a625825b60a0518f18455130575695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"0ba6095ced0c22c4974527bf1601e91ad26fdb9633a969255b40ac3b151b5e7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"c0b083ec2fc1a3ab9adcf766f5aee6a66960961c41c3c63836a6336fa945104f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"ba4fd17bdedfb57a0c3441c67ea8be06324527464c0ca54e0f7b1e020f9608c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"93832e579686254e6647bbe99864abdbe5a67d9fa759934ac94312f21c416252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"34d332f1eb88b2af92c85c8d2543b4528b4c50eda75d3fb6aee69daef2c453c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"66d98bd56e776500d44f45a0859b97d4562983d2260958e379ea35e9487ad4eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7d5b6ecac99a81903af1f07695f086c4bfd109bafab8f8194ad4b4fd091b34aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"b2b4d2e55bb399b589ee7e5e2cb4a7f725f020a25a59dc6455aaa53dd45398d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"7d652c0a553e29fb216d2deea09e5c3346e0879578a2d9458153f518172aeb13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c9017f020a8779df1bf1a4aa893cc309f09fc238e8d01959aa19111eb0b5ed65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c6b72d0a40389b38ea00360fdbcf1fb88e393c234225ed00a5a7c17770d9effe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"273f3c97f0d3804192fc0e01200c142ec51c874dee497a0c443d8b979e048ebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"3c2eed2c4076ab0ac01618527715b342fa5ecc8d9baa7c79f1feeb964c3799f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"6849f90c55719b2024e77469af36a9418435813fdba53de85548fc45c8041b2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4b68355e16dffced958b3c6cf6a85ace82156bf11ac5213f8a94b85b21483dd9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6e4d91976aaaeb7700bda58ca9f7d4fc8747fc30b47ad671e61c49301d3138c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e4f4c91d80ecb2b9c5e16dc7f16c85265f9b25ba1cdedb41f12bda22dd9a979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0ed28d60417f2be6fd8d8ca4e4f44017f1958dcb5f04c4b83faf3bc6eeab4d6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f475baaea88901f678e1e61313882f0906b83362598efaba02eeb7786e00c4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"bdebda30124b2b8564734f643be613c091aa384bca2e55611ab88e7cd4cd1e3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a31f206ab8dbca0afdfa573363aaccf106a7f54a5ec5ca868f0491263074ecb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"251af245b620a7fa0dd508c8b95ff9e02509b8bbe434073cf9b83ed0bf227633\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"413bdc5e3c8df93edf127de1f068c54db611a5add63e857a73c37db5c6778c81\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2dde942f6b0efa7d7693b097e74d457342dde9cd9f03e35cf7d39070c096b740\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"860dc65fe8df4fdb17f386090ff27961bc6e43ace3152d5a0c9832e5477eef9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3f40a08f9e67e8dea27e0ac184897b50a4a576eb35780ee92df8400cfcf89d70\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"19f5445fe08773500d55b3e72f93509c2849e7e895c1622c020ddc87da19fffe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"400cdf544c87d2cdde4a5d3684f85f830b61d03ef5e1b02d0be1783c7c45c882\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f540b85497841fd97f6f21f83df47eb33faf6a12440f4d57614189d4bc7e3f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"36893b95343f134093b02742f36ecfccd053fee778fdc4f679be27f0821f963c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ba6e1647cd84f03625de8a02d65d855c5b7014eccd9876502769172d848baf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"90d439ca579d037200d4b9b1351688c85e60d2b62c325dcd4c864dbca1f9aad0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0c780dabd6df0d31a9112fdc030e2d5ab45c634fa34c405e7c67193ba45c772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2b0c90ffa9c94815d4d916e763f757d711b83e43dc08707df89db7d8d8406388\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"22d7d611d13f7efc7d2839b9a4d644f15fce375261b2ef9f4c6f4a7c127c986a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"078831a5d217c20da318ae12d6aa231e9bbff23ac0abcd2591db8af03a0f020e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25b24056e5f00ce11ef07850b2b553069f88dfd09550c0f5ef9bd3abd7e8698a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"b093acc088f5b3c6abf3efd2b7e49c62fb4973951ca4bcb2de60b577d838bb0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce534ddc012dd199020559b4cd72e77478d843282db2cc920f6188c0ac48b895\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"fa2a9ebdd28b4100f82ad9bdbf5df9c5aa1c538e9c152619e7c88e18c7d108ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8dba5b80a8bbf465d2b8b22eaabcf3c0bd9ec9943de0ee152b6ff7246eec108\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"2213becdc51c61f7f2e2b6864f2180180274ae136569ddccfa233df684854720\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a2d41d1bfe2845a09f9c006079e27f8bda38d62da8cf25fd8a189dcff49f66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8b5df53b7e5c7e22beb55f83245651dce6a8917bcdf2dd35bc44cc2e3e651fdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbdcc0f989595829fe92a8e9a32d69ea8a40d9b8cf10776562925da6cc33aeb2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"7373120acb8fd2eb2c4957816e801ab94992057655f4e91e779b8aba2001382a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa6b3088cedb629d50bd69ee631bdffecde5a774bb58b1674ffbb601ff8cd135\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4e5201a1a8ee2abf1581a722b9b2764742922db1f0ff711794e338b7f65d0371\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda9555e5eb3a15f39830032fce44310c889ff832fd0ad45064af7e4bf34363\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"ef25a425e1d6dfe3f23ef10f30a834fe7f3b5ec9eeab376d9f7fedbf161693a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"715838e358b45a42fdfab1383d224600a95382ec941889a2a8cbf028b75f2333\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"f1d83a408601470954b72d92543728a94b837de1f26ba9bcea2689e096a9d18c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486256a75c498ab148cc9bb46bcea251297e2b74e1cf34bad3c55c74a14573c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"99754b4eef34970705761ee0d474fac3c0af931cfc8eeec218184e704566664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b402fefc886c9554b97ff3213c74deae584634017111f44bdedcad110954f5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"cf8a0e7503866d654dd35b207f84dd9afb7d006187b956dd25ac362a1582e4c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdbee3a9bd7f4b5ab291b0c7d51f26f71e9fde499c7da46ea9b0e5cd6486764d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"289d88ae80ca96598acfdb993945a9a7bc9728d40a7752db7cd5dfcc4255cf87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c01a1bbd47226264fe8f94e0d3575ca0ff85f4d02cb4b4ce6550ff37288daa4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"beb7bad3db035dde2975e132668d9e271e70d2a74fb9bf4ea61939150d443fbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75b7df72e9c7be8b9431666359ab3de5e8df05448b1f4b0276e5456fbcbb30a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"6ae83b4faccc867bb2b6cd562e04a27a61b810d3207c407f63565cd861a705c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5516d78005de2cfe8956e3ba1e8ec342a541cc4002706d987fcd519d0b67cf71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"dfaf750c9abe122c321117f70e65b282b6e2c59110bb0232a53f861824281705\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4556062116dd6b1b9e44244b886671cebc576038b0f9c1c1fe3e13deefafa523\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"5c9517da623973c54b0e61ed81b97b5019e20a39cee4222e9c2001fdb37f61c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa04b5c8a50845ad82f4ea9bd5f1f7c759ce4450149519bb00523b008482cb75\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6052d33df74209b62973bde64ad856897511f6c7fa48511e4a12fdc24287a50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad466fcf1c5c4d7345f6eb4fa5808cff0469e236def3863eb4783f677353d152\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"effd523d3498f1d53a6191e49c89ec1a161c7bcacb667779c6d8003047645c13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e8588abbd835e92bd8170bc89597b0d56f24271385f73e5fad17ec99a7389718\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"f4b7585e2b62ac0a7dbb3a671941f9be5fe33ba4c89700d7d3d938c179517ab4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08d9d2aa5fadedf5c6dfbc45eb4f9c34ea2a1882947995b5c79a92c618dd8d69\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"182222bc7dc75bc923b9c50cb3480521ab543e3d3f58674f35fa711b4a4fa69b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"061c7e4d1b1d8866722f6c06899571bde9ea56d77ea14ff59cf1d915e2d9b1c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"d755fedb11567ddbb0eb17e40e71678bcdffb7ce224b77d1c35bce75b6f556e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de657ac3c36b9a560af065f79a5ee929b70dec023b7155afc6b66e41a52fb273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"43f437f56d846d068e2783e265d65343acc185d8e9b1b43de9a84d4b8a4bcf25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c39303e83fe285ea577e6e31ef4627d8e9c1575ce9cbf3c5585da04dc9c3146b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c03721f568137f1d8835419637c079a8fab9caa0309f3e0567b19d99133eac2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7eedcaf178c841ed379be213f3f34665f16bbe619f0fe9ef35d71b19c579b94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"aa1b2e83bb519ec79fcb87c4512f8421b5031a1f66602c9fef9caa19a2fecc9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6be017c8c4a655f626b1a60defee892156238e99009d2e530b9cb9de189201a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0f30b14be9585141d957a722c9bee91c27f7cf218fba3d4916cd634fa6b8c5f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e43cec109a35717b74a3a54ae0f1006635a20b91c9de1e75a82c32f0339b4ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"0eb8bee651ce7b42a148f283b008ad1b9eab9530a3234bdeaa371aa9074c6141\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f17d178977a829b7cb25e144281dd8bc17cfea4201e8f9d6e4abd729b51db1b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"15b69076679c9ee18f60045fa3138d011c2d117b2656f00acad6ea10179f5206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ccb310d1f482e6b78361f68b84c67bc46f7ad1c23eca07e13b5c6a27a096cf5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"3006c2eb1cf0340b97d9cf4bdbdd7cea90026fcaf2fdfc3dd08c8e58ceae1938\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3eb001e52c79b1aa88f706bcbfda6899dd3d8312d2217dbb4f6b058a4602615\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"993295647de89316ed5016fc8beea92b6a66a8b34e5282043de690d88ac6d739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaae91b1f31dbd6654a5fd3c753d7ab2f9a54c9a352837dfd278c60a0fd25213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"411aef1a70bd99e949e340f4bff5dec9eb942d0e06e7075a78d572b412b7a939\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c928bea546bc63b3b8bd5d85d7a8f44207359e9772db70e9d65e9a38a136764\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8be814115fb7da807809a189087e4e033d326542da651f00ae28c8f14a5a6838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b458934204e7bd220bde8b2123b49c7fa677b901b7dc883fd85cbd8bef09f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"16517301869349c194fdc9624b1d4ecbd0be903f42b8c985af97867cf0023016\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ef3137adb71b08c83f1177afdfd70e3ceb53eb40eee682f1eb18aad1359fc66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8c7fce071dce1e65b18501c98e406d87231372ae5a9f5e8c347b65788df91aff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b13167a0b9b904765e5c7590d0ff54a0d4055061140144c50ac8d78e7f149e30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8e181d00f8b265fa8906db42847f65f424eec53caedb83469692e55f37e669d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a4b7d2121c1a0b6ea0d6f91f0b6dfca2759729cfe994a2eb6a6667e6b4edd0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6713bc99135c617edeeaade68698ecdf33d333131a77de2650c51b3b2fb36ef9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5eb305150bdafd8cd17ff8f66d77a2997545fb016d4fc2403dd456d505ca0b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"01277e6b7cec6e52c5ed8c8a780cb7fa31f56958fa93a2a5627034febf8791e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec9fcf7e18d4cac0d461636f2eca5067beeaa5440b72ee39b4f1cde5931fe481\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"41c187b864990629cecc9d75d09c283380fe5f99f4b35a1ec1a6932fb112a785\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9d90b0ca5be53b16d790c3082127cc7315e4666ae929559754734de0429c8be\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__36abeda2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1f00fd29cf32e564\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-simulator-w1-7966af\"]}],\"name\":\"4b58c3803487d40cd3d7d9dc63790243a7353b4a1f8b9fd9ae2c009fc55d5d8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"26e65caa35770dcea82c3bc46eb21156e68b0f237e536d0654e8b461fea79765\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__379bd025\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"e0859ceffca76d70\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-7966af/maas-trlp-premium-w1-7966af\"]}],\"name\":\"443894938bd03a0c0dfb1a13d4e30954bc3b4aef05764e52dc4647fddd6751e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a8bde041ff87e0d7ca43c9b2cb552d0278f317b6db01967ac7e2b21386b4bd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c1e45b5496eca64cf0b773c04ff151ed5a4c0fb5e66b08193d6941fdb5aeadbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1945604402dab22a2bb92e179c6db3181c9764e9e4b91fc7ed2f36d11c05b72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"d2cbb037fb718698317e136295b45ed06d5851b3e4dd7b69cc5d4284cfa0e31b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7966af"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:03.100Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"af36f543-2ef0-4c0f-9bff-90e2389695c0","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w4-de0ea2\" not found"}
{"level":"error","ts":"2026-11-04T00:20:03.899Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w3-11ea30-kserve-route","namespace":"e2e-models-e2e-worker-w3-11ea30","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w3-11ea30-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:03.989Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w4-de0ea2-kserve-route","namespace":"e2e-models-e2e-worker-w4-de0ea2","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w4-de0ea2-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:04.086Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w1-7966af-kserve-route","namespace":"e2e-models-e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w1-7966af-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:04.309Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w1-7966af-kserve-route","namespace":"e2e-models-e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w1-7966af-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:04.381Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w3-11ea30-kserve-route","namespace":"e2e-models-e2e-worker-w3-11ea30","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w3-11ea30-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:04.464Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w0-1c8dd4-kserve-route","namespace":"e2e-models-e2e-worker-w0-1c8dd4","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w0-1c8dd4-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:20:13.749Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","EnvoyFilter","AuthConfig","AuthPolicy","Limitador","TokenRateLimitPolicy","Gateway","ConfigMap"],"eventTypes":{"create":14,"delete":1,"update":14}}
{"level":"info","ts":"2026-11-04T00:20:13.991Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:15.251Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:20:15.359Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:20:15.359Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:20:17.521Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:20:17.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:17.527Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:17.527Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:20:17.531Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:20:17.532Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:20:17.636Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:20:17.636Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:20:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"1fd64820-8e0f-4a5c-a534-ac4baf2bada5","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:20:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:20:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:20:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:20:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:20:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:20:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"f2b1b8fc-6e48-4134-ab1e-c97c364587af","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:20:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:20:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:20:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:20:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:20:24Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:20:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:20:26.758Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:27.054Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:27.547Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:20:27.850Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:27.850Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:20:28.049Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-edf87d31","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:20:28.723Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"delete":1}}
{"level":"info","ts":"2026-11-04T00:20:31.939Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:31.944Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:20:31.950Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:31.950Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:20:32.013Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:20:32.013Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:20:32.614Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-de0ea2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"6e7eb8f6-4c81-49df-885a-1cfd92034b41\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:52Z"}],"name":"kuadrant-e2e-worker-w4-de0ea2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-de0ea2","uid":"6e7eb8f6-4c81-49df-885a-1cfd92034b41"}],"resourceVersion":"41538","uid":"ad417c34-a43f-49c3-8386-dfcd19d97287"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"8f41f5d27f92196508ddee2fc47e51daf5af5c4825a7e8591ede0800be949fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7a4e12ba594de064264e5a79bafadfb910f6fe0c5c088cc1d86aa478feff909\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"545e35b30c59a1aa62ea994b7a5be31f8d3760ca10aeb1ba456d4eea87cf7a6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"a4133ad72b872fc03206a842894304ad17b775369b97a617c5b595bdc943e826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"771078d889ef85b81946eff0b2ff32fbabcda38cbb208fa37bb96509f7d979a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"bba5991046822f1b6e0758327a2491b9658a798d2b607b2a7144f024f0067676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6d451581ca6171a655cb504496641e173bb76b72741c6c02eaed94083a536735\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"46cfece21c467f625b03ba5a104af0b1e8d4a213c5695ef30a112544f1c16cbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9d157bb2d1741f38e7e5854412ecaf7c47f4b489927c97cca666d33d1bb4d834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"a6089be44340b73e309196db9a8c89f042bf2d2570f1e88b8378d364827acdbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d186d8e5e42a867e2a08face337b9772aeae6ba493c896ca867692f02c4456e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"8d1e7b487515ecba92117549552071598f9233e149b32fc4eb13567225116a07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"68a9c4eb18e71677a594352b1b7ad0325a4c685212ace060db3b90da668c6f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"5cd2749f5fa499321c3a48c9e432951a046807348668fc35fed27b72ac6db3cf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9d55be3daa24118dde3ad2d28e0c6b48c00dd4df682a4745fb2c1e69a0bb735c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d5d96025b93f14012073fc9c61dbf91db95fa9ca2b726ddb91f601e538620862\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"06e46d8eb2da8005de0d157a8845a587567d7612ef6f79fc810ddaf2f78d6bb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"66272d32af643987684100422c0268e207c651a098012b0f2f6c77f68bc6d25f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"84d595c1af2ff8ed9ca0194212a4eeb97f3de15fbf7e225e4c6eb56d5a39f8e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"c13145cd6f1056971233d0e758c11ce8cee133a64eb3cf6a02b122d5a29a71a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"31e47065c52fb96c2470ed21a3d45c533ef5c080afe214081ff5637fa2b0d420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1b9a9d0030ed877e95dea36c3d55d7589cb8b6b826be9455de9bcdccb31c4a39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7db200bfe44cc9433850257d064b4edb5240dd6951e2251e271d79ce2599c45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"042db8e6145979020b4aa2ccc468918dcb1f32d03a1880a86a855cf8560eb16f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"5c91323526e4e1197474b1874d1ec0a636c457a84e2013e3688214b3c9f40292\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"56ff390a2f15a60052acfb6c577c0d99916ec6f8ec0c500a95983e8cd3ea840a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"26bea37b48ab2ee00f259c3b8c9bc4c47b26a86a798c02dc31f2843e47829ca7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"19013eb61834602135d4d3c8ffee368d3060b9b63fc5f9bf0951d431b8c38fdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"3b814cb972103fb740b36a5d13d0e90ab61a2243933f933f775c42677c1a5d85\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e7c8f0c364705957418c58fc49a204d16bc88650633ba572edfd632ab77f5666\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"91cab405f0636396c7771c6dc75f806c2ca022fb0848ae3c2fcbb33e22a339ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"67532e0078356f799dfcf346f3e77095d0c624d2d10cdeaa6e88f469fbb87049\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1b04bb6432aa7ede0fec0fc20a68d9446f453e5c05a3adfd45bf17a6f8b9ebc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d0d9929f02171b1ab4c86941d9f44cb58b54eeb19d2f221229eb30f01bcf7375\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"566ec84294cde50603c3dfa36bdf2a31651f5466d00e709b76f896a26cdc6f50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6bf0b16aa8962b07d84f7048f7b90a0b18983bd80e9edb53eef17bed17344e99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"12b5dd9ded539680a4677101fbb814ed65f93d791dfecc06a4e34ac1ca666285\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3feb12b2847f536be51d0b1e92294157bff9383e20f2265f92e3ea76cb048d9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9b267730031d7c70062f248c5d4811c04b382ca0287062b64928d46b92989d20\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"fd11e09603fe10b92e5b13701b94b1bc51bd77fefaef648e1161701b5fa58e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"68bd4c49aaa83b70448e00df2203ce7ce94bfe9c263e924f642ee7ca2732c5e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"f72767414d30bcfd4e1eb5788ae3b97e09949d30d08ca78756af19a21889315d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"685672fdf62a49b437cb02b0a5cf31117061b1cb305120627a24d822b87448b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"28b61973b7f554ada23df8f2adbcef9c3140a267f58ebf2ee8fb91ca7b72c4a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dac478a38580f45da71c649418701234a58fe64e526cb6afb7481ba444836b2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"36b0f5aa2c414392caa7ffd3bb635d11e950c904103befcfeb425d09f5b9dd48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"90c38ac2efd8fc638edcb5f7c8693ef7a3280fbb60b050b3849a607a39eaf69d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"03f1f356a7d76e767be8c0f275a64f6b98f09a8f3d04640561ef4c3f580d2783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"4402031351082e527488b2a5cccf7d68722dece1fa01370d5c21333ca6505522\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"b9c11f37fe72e97b7a55dae48d999a758e39f367ad7a116d7c28ae2380778fe1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1fae005cfbffbe4e3aaf50dbb8dd3b5a9f584045e1475c7738a315467ec67d5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"135dd5eacaaaeb159be4c9871fe73af3bfd928f5de1be32e147f296965866b96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"336d069594861bb5e759f874cb7b2f97e4c07a0dcd6170a429970f5f2d53ac0b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dfc32b1869457c56bed8d097b7c0a22a2a0b12e527f2acb8733ab9067d057c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e25322c24d98be7252f7c79cda0327987ee6ee4733d332ed5901e1b273397c89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"00bc5328f6973fb2115cb694774124ef334eba1a1cfc7badbab358850a407a44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"1f9f53047b22c1c17c09acdb0fd9c17eb0638398ecc1a9a37a86b01d811cccb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"96d4f3037b42b8b4dbb2b4c60ec972ab8af4ae9746f33d3238fb10f28f178b9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"310e1acfd0057c6e83529a4c7d8365e210e81104c28ddd0e12bf7c27c4f96a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"78c96b65770748aed921a19b6a2bd36cc8321c0a7dec5651a52e25bab7ad2164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dfcdd2ad233477f91e46e790091a8a25cccde3e540e5dfee8a882e70548b396d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"32a037705f978b303327717e1c0ec5e2335c0b26c10797f521b5135cf6a2453a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e6a99dc788b835aacddb6627c89f73143a475188279769039fa67efd06d375ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9960c39f056ac6bfdf36a15fd9c1fa7c853b27ad278ebc44f7ec6e94d68172d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"7287734b84ceef6341393a90e3ed4982016519f2ef7f9218e0807c5b41fe5f8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"45872a4dc74f3d9c8887e6e6522fcc3828da98c8175226158ad7d1e0d3a30127\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"688f84a7dff8577d0e7ac9a7d4ec36ff7dbdda50d779bc6b57d6aae8ce8b2fa7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"435ffa54404a9fbb884e542d138a68cfb6613f929fac5c1d075c32a78366f2c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"41543e9b40d595358566e7bb5bcbb2fccbbbe2135adcd30f456cbd888d802a5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"4aa7d5ab26c862da3f59d51848309ebfd14dd317c39eeefa3ea8a80838fbb716\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"80cec2e610c1806df05551724b800f012f0c084c1813547c1bbd670985b653f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"74df5489e7dfa47ee79eee83e342918f6531e925cfe1a798956b35da601d884d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"ceac94fca2ae9ea5cc47f3df0ec9d6a10b6251c722a213562fa646ea167dcdce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e619c29e635edd15be7867ccd71c115af280811a435be9acf9042fe6ce2369a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"836cd1aaeda4d6b267aa83969a7f76f361d3884106e3fe9a1a411ebc103c733b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"58317c757c8a458d1a8d6d5b7d8a3528d73c19d945347d61d3167c58a9f2abf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"811ca47fdaa1feef5760290388150e142b3763ef459a60d86cb3e223c6af9a2e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"484761bfa30c42040a68a552fd37e9c6794f6d1979ee07beb44e5d6b81c5f2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"c98397041d5e3535484e38692edcddb66bc94af55a8aefe7b372827b5b9a3658\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"df7b3104a100478ba86ef3efa2a83b687d49ec85b07c62e635a293b710028281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3fe8aaa75098b89c44ca3fe5a5cfc62dfa76bcc518cd59e8843f2e901b0a131d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"cfa45a246c21e687ad88a5b47e3484a2e94f500826f168a1b20a49a1094bc73c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-de0ea2"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:33.408Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:33.589Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:34.373Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w4-de0ea2-kserve-route","namespace":"e2e-models-e2e-worker-w4-de0ea2","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w4-de0ea2-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:20:34.718Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-edf87d31","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:20:40.979Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","Gateway","EnvoyFilter","ConfigMap","Limitador","Kuadrant"],"eventTypes":{"create":3,"update":122}}
{"level":"info","ts":"2026-11-04T00:20:41.279Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:41.319Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:42.943Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:20:43.231Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:20:43.236Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:20:43.332Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:20:43.332Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:20:45.461Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:20:45.517Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:45.520Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:45.520Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:20:45.523Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:20:45.528Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:20:45.675Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:20:56.693Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:20:56.694Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:21:07.136Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","TokenRateLimitPolicy","EnvoyFilter","Limitador","Gateway","AuthPolicy","ConfigMap"],"eventTypes":{"create":9,"update":123}}
{"level":"info","ts":"2026-11-04T00:21:07.290Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:09.453Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:21:09.614Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:21:09.614Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:21:12.149Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:21:12.162Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:12.172Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:21:12.190Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:21:12.183Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:12.190Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:21:12.183Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:21:14.205Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-eq-c29cf4","namespace":"llm","uid":"e3cb96ff-d27c-42a3-b43d-f484aabda347","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-eq-c29cf4\" not found"}
{"level":"info","ts":"2026-11-04T00:21:14.653Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:14.653Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:21:14.841Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:15.137Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-edf87d31","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:21:15.463Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig"],"eventTypes":{"update":26}}
{"level":"error","ts":"2026-11-04T00:21:19.967Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:20.273Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-edf87d31-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-edf87d31-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:21:30.582Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Authorino","TokenRateLimitPolicy","Gateway","AuthPolicy","ConfigMap","HTTPRoute","Limitador"],"eventTypes":{"create":2,"delete":2,"update":21}}
{"level":"info","ts":"2026-11-04T00:21:30.725Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:32.545Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:21:32.730Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:21:32.730Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:21:32.730Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:21:35.027Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:21:35.027Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:35.038Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:21:35.043Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:21:35.043Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:35.043Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:21:35.151Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:21:38.218Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:38.218Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:21:38.722Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-ac96ab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-ac96ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:21:39.676Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"create":1,"delete":2,"update":2}}
{"level":"info","ts":"2026-11-04T00:21:45.166Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:21:45.169Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:45.171Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:45.171Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:21:45.175Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:21:45.182Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:21:45.327Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:21:45.327Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:21:45.327Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:45.398Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:45.484Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:45.556Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:45.627Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:45.791Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:45.791Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-1c8dd4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:55Z","generation":12,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"1022736a-9ea6-46d7-9666-09e1fa7f216f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"}],"name":"kuadrant-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-1c8dd4","uid":"1022736a-9ea6-46d7-9666-09e1fa7f216f"}],"resourceVersion":"43266","uid":"c24c7f5a-e883-441b-9157-1c12216ad398"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d722f2773a064322e4f94bdd5518f8f21a17a4d3e9be728f24cfb4fd345e4e9a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"fe2d1bb96a8aaf1ce9dcb9486703a202aee72f3d53ae431bd7231723e5bd74fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"98975d104850538a792ccd19e2cc94afc3ee0ae0c91994978b98ef785cbde53d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"e044ebc76d11ae8f0f4842359b3802e3110f11079391259eeb5fc8dcd8fe98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"872c935eb7627fa9e9b54e9b64feca8fcf4db2fc6263c2ad9182de3020414f41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c16aef0a553732620ab3d17553727fd98cffa1f02446927a150f00d70e52c05a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"8a830d301ff5a71a133f2e5920a029e3ec3236b99ca7c335ce75edb2f135cd0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"8eba5c5e5bca470bce8d31262b89d1a43c350d64321474cb1389e98cce8f81c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"18618e03f7ceb171bbfc4325ef3055eae56f1ab466480d27270950382def7ee6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7e18ce43d7153957576261ea6bd1838cbd27e9221d7441a51d3b82467e783035\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"72ff7a0549b7f2b4006712493670cf5bcb7f7c53bc5317086464e575e8708f51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"55e881ef18d3f986c22031330e1ac075317ff8c7a8c7ff4fb15e6284e746f1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"deaeb61d09ab93f9f03227f87c16291cbf69018e9b985f45af50fd6bac96a4f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"498e7720200a468d4042e9bd9edeeb8ffed0aad4fe195cb3de0aaa2e7b1f7aa9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5557f0c59061b9b2fd5291c9ae974f8090764d56f8782ad1be7d9aa685dd069c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f2099f4d971741a51df3897453c41156341ec88be3551211a725467a0adbfd02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7a86223ba61568a2770448435689d6367383b116887b4e0f962f92d21f0d767b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"8ebb2e74c2ea0f835197bd8ac2f8e5e6aef50a2f05b7cab55e49ad3d0430e3ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"40baba532e9d879d798fe30bfe9c0d11138364343b9474190f8aad3b7b1f6915\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"dd26f053dbf977b8b193971505e36b6a07a706e3ed9c8e63c379ac2293d82dc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"06e7cf7c58cdf904f2014d394fc10aae12621f7f0d3ebe5dd26256424fc624be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2e73311a2a5aabc79b44092dbee50596338ae09ffb74ee1ec20dbf97865ad4a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"a2c40926c96848a1f64e2f8432e7be0de6c63c281170eedd68453cf218b53470\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"eb903fb2f395cd1e0cd0ece3e9569e47debc23b27198f10c2c299239c6fbc66e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f43c5685eb05b429ea9501f8435e99a510dded670763fd887490394976e47203\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"2f7853168e97bf4316ce3f174e5e8f601ff9b2184251eb8a5ff8c571e9117ad6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"07c8be951648c49fa94df5e261fd72b0d6a55d6d12d56aa4f6195a28d45ad73f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"2e484b0f507b4aef3f88f2d59b9740828b5202265477def64972b5a1e9821558\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c54fca81c42e570a25905b3c6c7d0a776654133d335a9e76b5c542fdd08244f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"88bfc8c650c883186ac394d93461aaf7a113b8086749088f88121f96d71bc350\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"b4c9c4ef3b7ed99d874118d7d71fab084fd2693839924bcb9390472e1aa57efb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"6761fc9095f50680da68f052e7bb745937e12a7fe6c0d00779b9df73c6ec1407\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"107c4fd088c79ed8fec71659768d87991ca27c12f0933f5856b0da18ddfa028e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"56d39e4652a0a101893e398463abb10dc9823cfd47192cabdd002e4ee6f525d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40da9b1442f8c865c6738c60853d840efd8a82bd368270d0d17d96b7ed7c0efc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cbca1d8ed9ab62026715b9dd0f4379e9ed34062cb0c5ff54adae4211b08f6fb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f6f7631a002f287686d1a42dfe6abf8ac2d9bbb36ba7b84b485fd82541e3675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7ab78aa758093de3cb3dfc32bc45f25e16886a2fc5e1820b9d810fcd1d1bb21a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd316c1011be2ba1e92977697277c74807ad2d7d8863195c9ce94350cab7ff36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fac652fd9b1dc98ff92020b3cf0cdf4d301a3c4bc17712267db67f99723e5918\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b46d7a290c8c6c1a20e45d9a689facdaf1135fae0cc244ef0623792814525c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"d30fac8f2fb796899bcd15432be29e9913ef74cc833b8fa9172fcb3032a894b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9b799c155c82bfacede075ce6f970c750ea8dde484ba3caa7b2a882b6227e2cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3664590b8723decda0f1deb0a6fac69e835aa6deb0d87841a8cb2078ce9eadbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08334bcfff931cd495c365f3735e3de949e766138a9b03ce39abc75f5f665541\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2987e31c5c3334f42edfdccb340b13f64ecb2e327c821bfe532cd3a9731cc0de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdd5f218bb1de67fdb4c5509a7e18511041e8821a02fa2e3f9adebc6b4874aa7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"4461e5dfd48fdc8eb0f2fa58b1fb467a8842997144340c53ec30b456d0c32819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa569c37ed600d105f8a2125beaf07c522497f53f11cf3099fd4e2348d46ec2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"304090cf99dcb2b139a39b24dbe0fc67b96e79e86d892ceecdd012c0fb5f51de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1eac59fc45114f2ce4deec1fdcf1c3fe2eb41f7adeda4c7ae7cfdc04fc65426\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"fa203dbd971b487b7333113774122af19d7dde397f3d8844cd2147b55778de4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1572ae59c6a795c338fb2bb2c6841973fa92ed1105168214da68a898a643cb43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"b9e1423918d69a0383c5a37f7b69c123793f9166183f73b9559bb7b0265193f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2e2ba829c80c6b7702bd26121920e6e561d643d373b81e6f19ca5d51bbdd17df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5e8ecb70760bbad248a21757c03c8916dfdcee1f2053ea966f59381c808149b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddca80e7dce3248bcb6173da3eae450a269cc516f706eef1eba2ea35c4a2688e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"abb79379262035a146f66aac08b02cff323165a37bacd7829b856522aca43887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaa1b2a1054fb53c8ff038dac01c6267251d8afd3e74e84cdc91d24302a4e4de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"88690102e83c0534cc670fe54962275c7b96e72ac65fdc7d75bd0787be36cd80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c93ae5417465b5195f2f67ba8d1b25b4900246774df9fe2f5df40220efbfcc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"067c2408bbf439d968882014e393801f8ee59b42a180a1e2f88edc16f1c380dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bea74a5e79312d86a7437b9b9107c9aa5f686e6d9a4148db2aa2d554135a8305\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f77376be4767c7f0d7b4cb876abc7c786544b05ffbf59e71c40ed738c0f23c8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7462618ce57719ee474fcda0c0f2b0a69b4be5f4fe22fb5a71662eace7c04552\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"610d27fbf7e70d25ca269c5f549054a67d35af30b7dd4fc784312db9cce4df23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6946f2258b914d5a4a901db43a29f69619f5914c83ce7f2253a5b15576a4bd1f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"982fadfb9a84692178e8203c6a490f473ab81889e372e8cb919c238a3141e193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e868ca29b1c1c2374441d92e4aaa1c6171e27635e90525412ba8c4bca24b59a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"585e58644bf42565979749c76320b49179d7aaafbcea3a586381c94c8ae91af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72285f03fe9b4e8619a5e1e3b78afb7d6a91af4b4ad126e8fe429adfa311785a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e39730b3bb03d3feaa6cedd97e009c3803c3c1e93b390e1f16359d23d2d4afa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f156043d80ae9202ec913856fc2ce218cc43b4082bacaa75b01f9a373ec0e57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"c8d3989af6b7881a200d5fae40430de3438a8a4fb910666ffb0c0fa3815ea2ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7a4155a07f6048125b423c1b6d272d77ea9bc24d7c897587107eb429ab2ab7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2ce83896170df3c28b859812d6e5a676644dc9aa0c347553cf19f4acaa03543e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07613ec6104cadec59fd785bcb990b5a38ea5343d6c74a38a40fad81b771b119\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"3dcf1f4a73977a1dad8f77938e6cb8b3e54b2d46359776c5af2e11edfab95c49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"250065119d3baa7879803f41eb65b32f6614a6a3f80fb2d03ecce0cc0e65ddef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5e826c20dd5710a6b7e7446075da02d64e4b09bc44ef94e039edb05484bfcc06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf1e7d0ef8559d974a1323420a3d396a5f1224745470bf01e5f84f9e90671cc6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7770ced6938234629c72124c64149fa0906e6875d3620e7f2a0b2b905a384722\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc98d55a5fcde068535f2fece4eb03bb9f733db252068dec8c93dd086be793a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"b51ab026204b7bae0773436ce72577fb27ecffcc646a0f6882afb62ede8abe6c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af5e6bdb6b32a2da886759932798d61fc00c2948cb89ef707a8c77de30dfbfc9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"27878634d95404360b653257f3b03d7fb2006ecd6ce2978b68a1d115150e59fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca78ecd27c5cb0159528b820a7be7092275b9c5abdc62b572dedb7e627141373\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fde88c7e29be0745a9e8705f9903954fa2823d8ad2133a839db3d5ed96adcfb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4de96f4310ada6e084741030e975dd1f38f92b2a8c4006206161b34924f621d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"025285dc38f097b725e71fec4cf5f71217b8dffd5d74f733fc8154e122b6034c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ccf4f502d8f42eaace6b37e237896d6658342da096b8598da2567e1a97cd7a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"f53d7752e5e8872a28aaf4951c5bb99e52039e2d080871c4e28011c2328f2109\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0442670ca837fcdf5b5b65185966e09a927dc7aa7c0ef0689658297531f91c7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"55f4c111860bc29246c5f77e3c4e7d48647a53865883b40ae1e8515b9d02d7e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"126b28f315255821a23330f516efbe14a895b48f838ed4577489e7c3a7e289df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"4589e1b797c1c898e5079ae6dc96acd6d38d4718919b2f08c1eb7206448b4ab2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"496e1bf7f5641b54d2165111905fa143e0caac6fab14aa60c4c4ba36d8450772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c345c923befde091471bab05f155033e00973c1f4322f2d695969ef630cdaa8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6fcf011ad844ec14108de764b81b128fdb18fca9ddf8aba8087b147dd4f5bfdb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e36e9ef49d9eee750dd3bdaf13f7427ea50658d943798c5936bd4022a828fe2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"667d3a93329c566724f271b9c13e60b7d3bdba5a17c57765887854900434892b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"1826d28a53942692d22546698b1e127e9f6cf018551f0976553bfa20e5361993\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b79bb31b42338d4a406a8314ccd79dd125fccbb0f1321cba1e6e2a76810ca65c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"505c2b2acb351d14b73deb47ddc79ae294a4d0b7167b7f38f6dba24dbf4019a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb8bac264d82224c8d8c821d533af6243655e8d48c8764ba43c2d9a52e624ff8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c1b45264e1ceea9ba7c7c57d22e4cee07e3c66a3f40f55a0fb2a02229878d689\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2a39cb466936ed344ff5b35e07f242e326fab27306803cb683ba6df545a69c4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"a0ffb3b8c11614dc5ff46348cca0e094c00ec437821e91a13a57b7b7a5195acc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2319eed8b4ef51b4414ccdc8857bd036554e70a55cfe750dc216906486952a53\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2eb301e5e4984be512b687e16a81a3a6a6ff2d80d4a23d38db2a15f8d2c5e23d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aeb0450fc0ede1b61e5bb1612230e6cc8cc7b2c66ff5bd0847078f3b01b444a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3224b08ceb25452655701219f7d2126150d377f4f0fcc7a7353e4e15cca11871\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8542b97537c28e07d57bd0a9c9474f31b46be9996c4e9bfc3475585960e95017\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7af45dbed1145cbefae25036f9b976a4ba04ff1bd6d65257c779e505c08e7664\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206405c4fb067243fdbd7964f80dd6bb48a9e3ce2c5335c82aca73c228e43441\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cae718fdd03b8a36914e865ce59f9f9820ec9eef12d4d0c9c6228b86a7fca262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"88058e8c9de15d7da1fea7024cba67237bdea366968f5e13ad3e9c0be8b34c46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"d78e0b7b2fff91bae4004dc0f09025510ecd9eb4f6ceef5f1004705995ee6e82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2028771388f8279a0773be1740d35e06fd4143c31788bceed01bae9e8689e4e8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cb1bb94e9eb8722108b82378027c9a6cc6927392f2679669c7127da5b93d7f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45b69d0a2617fdc908edabde94957a37df9bab4d7c8d1f0da2d3348571dfe24a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"58271f39ba379295948cabb3698a9f3eb43a28dfe7bfe008e8ed6a9586432164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8a5f0bed0ea44e46c7ffd9439a1c95a25744aaa30796c29dedf2f67e0718e99\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3588a32f4036d13fb6b19114219c46cf512773bda9a64cb8254668ce2f84bbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67f92abfa1830b39b11b6fba47fa111e608ce1ecaf6453884763534c3d3fb793\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d43defb9cd59af289b9dfd9879f86908b2485fde88b5f2ad80ad79a573e5025c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a38a3aae7b31ec5ea9420576df60ef9fc1ea0e252b9d3d96184215ce79b3226\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"de97507b575cf8eeb6ed5f8969e3e733c20f8d71018e39890aa1f57e803f4cf2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3e3834d3118318c51dffc32390603e36934595c5092fba7c22201192be37f07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"dea8f45890cf588ef4a93ce717a6523504e30c4b7c1cf6c22aaf2399d55c00f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce72d6ea777e1d3f6b60618a850b52e098222a66964c7963514746d1d3dfe27\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"e8ccecc36ea50ab185e2cb24105f0d05a0d27ca156cd2483b712a076fcbf67d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-1c8dd4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:45.865Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:45.954Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:46.005Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-mt-edf87d31","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:20:46Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7fa4c0d1-81af-49e9-886a-488a726264a5\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"}],"name":"kuadrant-e2e-mt-edf87d31","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-edf87d31","uid":"7fa4c0d1-81af-49e9-886a-488a726264a5"}],"resourceVersion":"43283","uid":"78438fb6-a052-4d96-870a-c69ca47a0ac4"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"c7c318b8a800ed79893d7ec30fb6bea5709785b850adf37008fde84bbbfa1ecc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"c85dc1e92e77cebb74a77b8996f4eb3b3d8d5d202c55d4d0b8167ce28730045d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"3c089d78349ab50ea2f6c8fbb9d60fc771b4bede6ad7c34f61a881de543ed0c5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"cd9269a693977ac5b12450675171c25afea34dbe7475c1a23a41a30816d5a1d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"5e0ed41734ec2c6eaa96d11c7ad5ea7eef425ad7166d330a8227eb0fe6c2a208\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"c142479cb01824530f5a8284185c9bb6e86b592439d2e6c01d902dcda4724ec7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"a89f2b798fff745d5d3557cf63942ee08d4fe82efe6b1e105b3aba2fde73a3f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"a20027b045e5b919cbe9d0ec0080abfa45698010d7fb62f1d260a42000406288\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"d2ca77557ab01138baf551f3986fd4cb0ca880661b0fb352dc7908284ad55367\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"c36f6f09ee60a04ae934841b597d8bad498a15cefddee4ddd855e85b1fc1812f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"9309751659b0e111ede359999e060fa991156b45d95802f05ccac588e8101224\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"b5d10f198ce47cc3e2c3f8279e044d2e0b9511d88481b2269649472658782772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"a3513ddef44fd5b7e9be24c1859499140fec5a1a44d23335d3d6d1f6b826d0b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"12803fe248964104b6068ba44104c9bbf1f108bd567b4058a023287f4d0774a8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"7a1aa74aa0d8dddaf7da69be2ecaf8dc3949957ff1a85cba3a4bbaddf07587b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"01c7996124d947bb8617f84ea565a90b4ad75409af33f5653fd6af8d78a712ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"d3212e10b806c4d83df1c007d3e6a739298e21941ef3a19d3041abcd3b5b97c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"f1ad56dc14a47d0d72de1b992269bbbb2aa42159f70d826d3d9e847c8340840a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"6a71d4e15832a582e8fa3e06e51c38451752e7e65c7d0aa5a28a0809444198f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"97a7bb68e056fad9535c691be21e81c117f1e482f0f9d795a2eafd73bf7084f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"89ef453b3e838043c0ed8e43552c8d3bbaf1c890b7282199b73240255c291dad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"3281508d74a1cc3c29e299ae9e6a0b42e23e49e51af4015f6e7bf4e5b9883cab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"0644f257e2748c3c56c43d051eea83fdc4e48218040b9488baf40c205d0aff31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"4088bf276227f4e9dce6c8cddcbb15a552aad75bbe8b7f2894737d824e4962b3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"253fb52d17cff7f5d77f6346ce4315c431cb9bc9e6d2cd7270994586c0cbce23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-edf87d31"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:46.031Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:46.103Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:46.230Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:46.306Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b\" already exists"}
{"level":"error","ts":"2026-11-04T00:21:46.363Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e650546f9b4cb104b5117d1901c549cfcca82a47d4a2041d83d3b4f243842712","error":"authconfigs.authorino.kuadrant.io \"e650546f9b4cb104b5117d1901c549cfcca82a47d4a2041d83d3b4f243842712\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.418Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/46d0ea094db7fb68e09edd47260f5364d85b5601e22fc9680c0888b9b97939f0","error":"authconfigs.authorino.kuadrant.io \"46d0ea094db7fb68e09edd47260f5364d85b5601e22fc9680c0888b9b97939f0\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.472Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1e22b08ec39e7dc42b043d3268d03078cbaa5c763115258d264f73ad40a52513","error":"authconfigs.authorino.kuadrant.io \"1e22b08ec39e7dc42b043d3268d03078cbaa5c763115258d264f73ad40a52513\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.527Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/347b46f79fbdce834fed8b3b07aa5064b64fc9edd4dda288c111e8dd35337296","error":"authconfigs.authorino.kuadrant.io \"347b46f79fbdce834fed8b3b07aa5064b64fc9edd4dda288c111e8dd35337296\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.583Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/76d5593fdce1fc7842a5d298ef4e5edd1bda831bb986403acea558b3e1a3ffbb","error":"authconfigs.authorino.kuadrant.io \"76d5593fdce1fc7842a5d298ef4e5edd1bda831bb986403acea558b3e1a3ffbb\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.638Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5ddf93fda733576262586df9122ede6508f4291b13d6f05520583930b78797ed","error":"authconfigs.authorino.kuadrant.io \"5ddf93fda733576262586df9122ede6508f4291b13d6f05520583930b78797ed\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.654Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:04:16Z","generation":11,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"af1b8c6b-0ceb-4134-aa61-de1746b60d18\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"af1b8c6b-0ceb-4134-aa61-de1746b60d18"}],"resourceVersion":"43280","uid":"edcce1ea-eb55-46d5-a2c7-9f7dda82aae1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:46.693Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/58b3da49dd3b3d0d1f9e8778eabfc154a6d9991d5161d6ce331b69f83715a292","error":"authconfigs.authorino.kuadrant.io \"58b3da49dd3b3d0d1f9e8778eabfc154a6d9991d5161d6ce331b69f83715a292\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.747Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2386f78586b07848d72ef25f65e56a82de64c64d6e5291578f2aa702f02aabcb","error":"authconfigs.authorino.kuadrant.io \"2386f78586b07848d72ef25f65e56a82de64c64d6e5291578f2aa702f02aabcb\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.802Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0b5944b39505e3c077a99c8c606d1fdfb587020a68d1b5eed351b3972c0f5a18","error":"authconfigs.authorino.kuadrant.io \"0b5944b39505e3c077a99c8c606d1fdfb587020a68d1b5eed351b3972c0f5a18\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.856Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3f94293fd77a8cadc9490a7fda0199caa37a5bf5d14123d69cb2f7865175b771","error":"authconfigs.authorino.kuadrant.io \"3f94293fd77a8cadc9490a7fda0199caa37a5bf5d14123d69cb2f7865175b771\" not found"}
{"level":"error","ts":"2026-11-04T00:21:46.976Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.035Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-edf87d31","namespace":"openshift-ingress","uid":"313ebba2-cc2a-4d89-b139-89ccf75b6c4a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.093Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.154Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.214Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.273Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.319Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-edf87d31-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-edf87d31-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.332Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.392Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.633Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.691Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.750Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.809Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:47.991Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:21:47.991Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:21:47.991Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:21:48.213Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-ac96ab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-ac96ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:21:48.289Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-lifecycle-model-edf87d31-kserve-route","namespace":"ai-tenant-e2e-mt-edf87d31","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-lifecycle-model-edf87d31-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:21:59.093Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","Gateway","EnvoyFilter","AuthPolicy","Limitador","Authorino","HTTPRoute","ConfigMap"],"eventTypes":{"create":13,"delete":10,"update":22}}
{"level":"info","ts":"2026-11-04T00:21:59.393Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:01.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:22:01.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:22:01.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:01.348Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:22:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","reconcileID":"b5496bfa-dfc9-472c-bc44-4515146f585e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:22:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:22:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:22:03Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:22:03Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:22:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:22:03Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","reconcileID":"0c09f84d-1e8a-4b75-bf89-99c084d8acf8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:22:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:22:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:22:03.716Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:03.724Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:03.724Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:03.729Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:03.730Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:03.746Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:22:03.746Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","reconcileID":"adaaa65b-6735-47ae-a44f-e1bbcba45351","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:22:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:22:05.995Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:05.995Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:22:06.762Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-af2b39","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-af2b39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:22:07.152Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T00:22:11.024Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:11.030Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:11.030Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:11.036Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:11.036Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:11.041Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:22:11.041Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:22:11.987Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.266Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-edf87d31","namespace":"openshift-ingress","uid":"313ebba2-cc2a-4d89-b139-89ccf75b6c4a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.325Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.383Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.392Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-edf87d31-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-edf87d31-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.442Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.500Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.620Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.679Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.739Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.799Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.921Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:12.985Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:13.050Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:22:13.111Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:13.111Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:22:13.503Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-af2b39","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-af2b39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","reconcileID":"18d29fc6-5ebd-4d0a-a492-fec5ffeb259d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","reconcileID":"edbd8c56-94c5-41b2-833d-8a8038c54225","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:22:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","reconcileID":"31ca3335-a819-4268-acee-5622e4a6ffd5","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:22:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:22:23.524Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Kuadrant","Limitador","HTTPRoute","Gateway","ConfigMap","AuthPolicy"],"eventTypes":{"create":5,"update":19}}
{"level":"info","ts":"2026-11-04T00:22:23.822Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:23.842Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:25.731Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:26.013Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:22:26.131Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:22:26.326Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:22:26.326Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:28.524Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:28.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:28.531Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:22:28.532Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:28.535Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:28.535Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:28.690Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:32.665Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:32.665Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:22:33.010Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:22:33.836Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Kuadrant","TokenRateLimitPolicy"],"eventTypes":{"create":2,"update":2}}
{"level":"info","ts":"2026-11-04T00:22:33.983Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:34.003Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:36.424Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:36.432Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:22:36.433Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:22:36.635Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:22:36.635Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:39.335Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:39.339Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:39.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:22:39.349Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:39.355Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:39.355Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:22:39.452Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:22:39.452Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:22:39.452Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-af2b39","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-a-af2b39","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-af2b39","uid":"98378ebb-5a91-4781-ae6f-16af966e6044"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-af2b39"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-af2b39\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:39.453Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-af2b39","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-api-a-af2b39","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-af2b39","uid":"98378ebb-5a91-4781-ae6f-16af966e6044"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-af2b39"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-af2b39\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:39.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-1"},"creationTimestamp":"2026-11-04T00:20:53Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:20:57Z"}],"name":"6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718","namespace":"kuadrant-system","resourceVersion":"43624","uid":"24894a84-c41c-42e7-88a9-566249af4195"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:39.513Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-ac96ab","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-a-ac96ab","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-ac96ab","uid":"e2ba2671-05bf-4603-aef7-19dc64ac3034"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-ac96ab"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-ac96ab\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:39.514Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-ac96ab","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-api-a-ac96ab","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-ac96ab","uid":"e2ba2671-05bf-4603-aef7-19dc64ac3034"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-ac96ab"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-ac96ab\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:39.525Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:39.599Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:39.672Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:39.738Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74","namespace":"kuadrant-system","resourceVersion":"46948","uid":"8782b45a-ca81-44c2-bb5c-04aa90172c51"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:39.805Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf","namespace":"kuadrant-system","resourceVersion":"46966","uid":"abbbc494-8868-4b3b-93e5-7d6a4057ef9b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:39.871Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:36Z"}],"name":"bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c","namespace":"kuadrant-system","resourceVersion":"46975","uid":"1456a81c-0d28-40a1-9253-33667d4b53fb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:39.938Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648","namespace":"kuadrant-system","resourceVersion":"46952","uid":"7ecb0ae9-2ca1-4ae2-9d3f-d308ba30791e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.006Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-2"},"creationTimestamp":"2026-11-04T00:20:46Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"}],"name":"c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22","namespace":"kuadrant-system","resourceVersion":"43284","uid":"5200af56-cd79-469f-a0cd-51e9a1d47d09"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.073Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:21:36Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:37Z"}],"name":"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a","namespace":"kuadrant-system","resourceVersion":"47019","uid":"e8e7a723-fb59-4b9c-b834-fb55aec20839"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:37Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:37Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.112Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-ac96ab","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-api-a-ac96ab","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-ac96ab","uid":"e2ba2671-05bf-4603-aef7-19dc64ac3034"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]}],\"name\":\"8ff4f8cbf4b8b495e8f176b6ffe5091674538fd89b6a53a2ec421dec3a259795\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]}],\"name\":\"18f533d697fcfed2393639869bba2f3d4559dca837ac4d516efccdc5efb1d525\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]}],\"name\":\"6b4c2c88a52ba9c3bb2cb70002285632ffce6473cc02adbedc02a5e477395a6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]}],\"name\":\"dc06e46c782c0d30e267e5c13626c9f3057b7c654a9df1c9bcf86268212a41f1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]}],\"name\":\"315b3123c24a68d0166a2097e91ee946ee77c9f405d7b14bc98375577b7affd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__25d7b8b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-ac96ab\"]}],\"name\":\"f6bd5f7b134e3d0f1ebe7dfd4b40f16be7cb1f79b6a4a3e0eaaa85d2a8dbe9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-ac96ab"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-ac96ab\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:40.143Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:40.213Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:36Z"}],"name":"30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b","namespace":"kuadrant-system","resourceVersion":"46968","uid":"5f3de749-6b01-4d76-9b44-6749cad05bbe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.238Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-mt-edf87d31","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:20:46Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7fa4c0d1-81af-49e9-886a-488a726264a5\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"kuadrant-e2e-mt-edf87d31","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-edf87d31","uid":"7fa4c0d1-81af-49e9-886a-488a726264a5"}],"resourceVersion":"46963","uid":"78438fb6-a052-4d96-870a-c69ca47a0ac4"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"c7c318b8a800ed79893d7ec30fb6bea5709785b850adf37008fde84bbbfa1ecc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"c85dc1e92e77cebb74a77b8996f4eb3b3d8d5d202c55d4d0b8167ce28730045d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"3c089d78349ab50ea2f6c8fbb9d60fc771b4bede6ad7c34f61a881de543ed0c5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"cd9269a693977ac5b12450675171c25afea34dbe7475c1a23a41a30816d5a1d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"5e0ed41734ec2c6eaa96d11c7ad5ea7eef425ad7166d330a8227eb0fe6c2a208\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"c142479cb01824530f5a8284185c9bb6e86b592439d2e6c01d902dcda4724ec7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"a89f2b798fff745d5d3557cf63942ee08d4fe82efe6b1e105b3aba2fde73a3f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"a20027b045e5b919cbe9d0ec0080abfa45698010d7fb62f1d260a42000406288\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"d2ca77557ab01138baf551f3986fd4cb0ca880661b0fb352dc7908284ad55367\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"c36f6f09ee60a04ae934841b597d8bad498a15cefddee4ddd855e85b1fc1812f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"9309751659b0e111ede359999e060fa991156b45d95802f05ccac588e8101224\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"b5d10f198ce47cc3e2c3f8279e044d2e0b9511d88481b2269649472658782772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"a3513ddef44fd5b7e9be24c1859499140fec5a1a44d23335d3d6d1f6b826d0b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"12803fe248964104b6068ba44104c9bbf1f108bd567b4058a023287f4d0774a8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"7a1aa74aa0d8dddaf7da69be2ecaf8dc3949957ff1a85cba3a4bbaddf07587b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"01c7996124d947bb8617f84ea565a90b4ad75409af33f5653fd6af8d78a712ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"d3212e10b806c4d83df1c007d3e6a739298e21941ef3a19d3041abcd3b5b97c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"f1ad56dc14a47d0d72de1b992269bbbb2aa42159f70d826d3d9e847c8340840a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"6a71d4e15832a582e8fa3e06e51c38451752e7e65c7d0aa5a28a0809444198f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"97a7bb68e056fad9535c691be21e81c117f1e482f0f9d795a2eafd73bf7084f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"89ef453b3e838043c0ed8e43552c8d3bbaf1c890b7282199b73240255c291dad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"3281508d74a1cc3c29e299ae9e6a0b42e23e49e51af4015f6e7bf4e5b9883cab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"0644f257e2748c3c56c43d051eea83fdc4e48218040b9488baf40c205d0aff31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05de747f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-edf87d31\"]}],\"name\":\"4088bf276227f4e9dce6c8cddcbb15a552aad75bbe8b7f2894737d824e4962b3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-edf87d31-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__17bcc6c2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4efaf0c9b88d2674\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-mt-edf87d31/maas-trlp-e2e-lifecycle-model-edf87d31\"]}],\"name\":\"253fb52d17cff7f5d77f6346ce4315c431cb9bc9e6d2cd7270994586c0cbce23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-edf87d31/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-edf87d31"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.283Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:40.304Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-af2b39","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-api-a-af2b39","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-af2b39","uid":"98378ebb-5a91-4781-ae6f-16af966e6044"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-af2b39-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]}],\"name\":\"3b77da88395f3f22e9803c3afa5a069747447c6c9b9bb05ba658954432df376e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-af2b39-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]}],\"name\":\"1a5bc08773c34729a98c02a47aff3123306b72cc8b7ac5b6ca024011689821d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-af2b39-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]}],\"name\":\"00a0afebf904a51266078bd66479a144fa2018a4c6005100a18c8ec17458d4bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-af2b39-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]}],\"name\":\"b762f96a597f9445902c563723cf277ba96478f0ba1b6562b87f9ab78d699a02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-af2b39-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]}],\"name\":\"51d8ff93f87b8321149806dfe40fe405a05128b3cfbb1ec8aff171c11a9e3183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-af2b39-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7860f78d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-af2b39\"]}],\"name\":\"d6ea897487f7c955d81b2fa595e350fc2c9ebcb001e294796c38f1ec3d2c31a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-af2b39"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-af2b39\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:40.361Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:40.433Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:40.498Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03","namespace":"kuadrant-system","resourceVersion":"46955","uid":"5ac8316b-793f-4a9c-9724-6e988dd667ad"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.563Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-4"},"creationTimestamp":"2026-11-04T00:20:48Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:20:53Z"}],"name":"eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f","namespace":"kuadrant-system","resourceVersion":"43502","uid":"ebfd0e48-0480-4b86-a580-4c1fda702325"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.635Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:40.704Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56","namespace":"kuadrant-system","resourceVersion":"46941","uid":"d3d5f6bd-5d04-4638-a911-a72e42cabb37"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.771Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65","namespace":"kuadrant-system","resourceVersion":"46939","uid":"1a18ce00-def9-4a11-b2c0-e17fef228f3f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.837Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:21:36Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:36Z"}],"name":"27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f","namespace":"kuadrant-system","resourceVersion":"46992","uid":"e38112a5-1a00-4653-89de-b4ce8c083477"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.903Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-6"},"creationTimestamp":"2026-11-04T00:20:48Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:20:53Z"}],"name":"eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010","namespace":"kuadrant-system","resourceVersion":"43491","uid":"54f87341-414c-44cc-b631-5b4c103b03ce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:40.968Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9","namespace":"kuadrant-system","resourceVersion":"46950","uid":"31952ea8-4bf3-41af-8fc8-c170817aa285"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.042Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:41.118Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:41.187Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-3"},"creationTimestamp":"2026-11-04T00:20:50Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:20:55Z"}],"name":"bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358","namespace":"kuadrant-system","resourceVersion":"43572","uid":"8c9e961b-41fd-48ad-8ff3-e07787d3df1a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.257Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:41.335Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489\" already exists"}
{"level":"error","ts":"2026-11-04T00:22:41.402Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-5"},"creationTimestamp":"2026-11-04T00:20:55Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:20:59Z"}],"name":"913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba","namespace":"kuadrant-system","resourceVersion":"43680","uid":"81a72254-4fbe-4d4d-b840-8ab32d6f90d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.467Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:21:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d","namespace":"kuadrant-system","resourceVersion":"46961","uid":"5f68bc60-7da1-47f8-b053-3903ada4208a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.530Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-ac96ab","namespace":"openshift-ingress","uid":"e1744b27-ca7e-4951-b76a-647c72ba65e2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-ac96ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.594Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.652Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-af2b39","namespace":"openshift-ingress","uid":"df02ee72-4766-4b77-9fda-5105f3e2e18c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-af2b39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.773Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.834Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.894Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.925Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-ac96ab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-ac96ab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:41.953Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.073Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-edf87d31-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-edf87d31-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.138Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.140Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-af2b39-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-af2b39-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.198Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-edf87d31","namespace":"openshift-ingress","uid":"313ebba2-cc2a-4d89-b139-89ccf75b6c4a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.256Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-lifecycle-model-edf87d31","namespace":"ai-tenant-e2e-mt-edf87d31","uid":"bb8798e2-90a2-47ec-9bfa-8e75b510b588","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-lifecycle-model-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.317Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.438Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.557Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.617Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.677Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:42.797Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:22:42.797Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:42.797Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:22:42.960Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-a-ac96ab","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-a-ac96ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:43.031Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-a-af2b39","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-a-af2b39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:43.331Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-lifecycle-model-edf87d31-kserve-route","namespace":"ai-tenant-e2e-mt-edf87d31","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-lifecycle-model-edf87d31-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:43.389Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-ac96ab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-ac96ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:43.518Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-af2b39","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-af2b39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:22:43.579Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:22:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","reconcileID":"0f89c237-11b2-43e4-8112-1aa8f7543294","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:22:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:22:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","reconcileID":"f1a3f297-d384-4c24-810f-9629dc0ced2a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","reconcileID":"97b3619d-63b1-4811-9f12-4bf08d376a3a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:22:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:22:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:22:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:22:51Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:22:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:22:51Z","logger":"plan-policy-extension-controller.controller-runtime.cache","msg":"Warning: watch ended with error","reflector":"pkg/mod/k8s.io/client-go@v0.33.3/tools/cache/reflector.go:285","type":"*v1.RateLimitPolicy","err":"an error on the server (\"unable to decode an event from the watch stream: http2: client connection lost\") has prevented the request from succeeding"}
{"level":"info","ts":"2026-11-04T00:22:51Z","logger":"plan-policy-extension-controller.controller-runtime.cache","msg":"Warning: watch ended with error","reflector":"pkg/mod/k8s.io/client-go@v0.33.3/tools/cache/reflector.go:285","type":"*v1alpha1.PlanPolicy","err":"an error on the server (\"unable to decode an event from the watch stream: http2: client connection lost\") has prevented the request from succeeding"}
{"level":"info","ts":"2026-11-04T00:22:53.869Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","AuthConfig","HTTPRoute","AuthPolicy","Gateway","Limitador","ConfigMap"],"eventTypes":{"create":19,"update":46}}
{"level":"info","ts":"2026-11-04T00:22:54.007Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:55.733Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:22:55.853Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:22:55.853Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:58.732Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:58.738Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:58.751Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:22:58.752Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:22:58.757Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:22:58.757Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:22:58.918Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:02.270Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:02.270Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:23:02.395Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-676aa1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-676aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:23:03.535Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","AuthPolicy","TokenRateLimitPolicy","Gateway","HTTPRoute"],"eventTypes":{"create":4,"update":3}}
{"level":"info","ts":"2026-11-04T00:23:03.629Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:03.649Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:06.049Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:23:06.138Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:06.234Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:23:06.234Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:06.235Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:23:09.124Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:09.131Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:23:09.124Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:23:09.135Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:23:09.136Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:09.136Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:23:09.188Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-18f9ee","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-a-18f9ee","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-18f9ee","uid":"c90b69e5-1018-4c77-917c-452e4657409c"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-18f9ee"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-18f9ee\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:09.189Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-18f9ee","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-api-a-18f9ee","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-18f9ee","uid":"c90b69e5-1018-4c77-917c-452e4657409c"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-18f9ee"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-18f9ee\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:09.237Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:23:09.237Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:23:09.252Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:09.324Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:09.396Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:09.467Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:09.582Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-58b06e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4fcb948c-b646-4a79-81f0-c8c8b238ba80\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:14:49Z"}],"name":"kuadrant-e2e-worker-w2-58b06e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-58b06e","uid":"4fcb948c-b646-4a79-81f0-c8c8b238ba80"}],"resourceVersion":"32975","uid":"732b86e6-fa81-4635-acf0-7deb37d6eb21"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"e146aba91e806fec4ad460501c64f088e7918b3c7df4adc5b88bc6c3faf2ac37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"9dc9d9cec315591800c88f4289e106e101bea3f744c5b9e8db2e7bee888f56d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"63ec76d05da6d8eb8438f4440655f88e11dac33ecc007fa0c01af712b41e570a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"91ef8a3906f365286d0019bcfbefc55ed221a2b34a354423d7e5aabecdfc1e41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fe787d97dad775e52b0925cb3b1fc11a2cccc1c1d01be7803ffa54e7a5c34f04\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7518d66fa47f7f6cabe6c14b9e1911316826c977ac3ad6142125da82716ee49d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2a2f0db09cb2fb6f2f7fb7aae81d3230cdc54b055d10cab642b30512426ad32e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"a264fddac0eede3bb186a56c3d99c2c84f52da822bfe449896c63e80d378fa6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"975ea7be7a86f3bd7fd50267137f6de8065399993c7f63b59c191559e47f793b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"a95a55523a043ed134414c098458e5a7d6983ab83c6259ae31d9d5fa9a8316c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5cf451c78d8f4be30e60bba48086bdc4cf8200cc3ebdbab4eb91c0d2d9e57068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6118193c4ed945f459e205e00e6416c96e49516833c47b89d6ab4cf069c93dd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"1369d79269306e5fa8bcaf6aa97220019e84961c9b6a9afc7b7b263f0ecb49b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"2480cdb507fa123566b39943d7f0d47eaddf130eba838a9db19503d4f513a022\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"9bc8ba0637406af8bf8245d440db5a33901d9b4f5074b872b15869bdd6287a09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6ace09d0808b0cc3ec8485b92185031610ea8a5f271f1d1b8533399d7cd3c81f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c74893123203fae1ad8050e640815fae46cdb7fde29ebfbefa3b6065bc0b820d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5c2c66b930801af0fcd5415e60c1646e4cd4d22f4cab4c51bdb2f5aa9db1a342\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7b596cdf84908424c0234d4546947508d061e01a9490fddfb346ada7a88d98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"567d9ef227a1b0e29d280dbfeb4eacab7843c88000a805f0ef359193c69a8189\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e40f041bd75dbf3b0658d7a49adba76e80113241cee931f90f0c37a1149955ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"8a3503393c3e9bb4af6707deccbd9de501af9ca64c00bce65971025fe6d62c10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"053fe182975a90257bc91bb8a5ba18938a225856a6ec12e179a0dc901e82026c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6ed13fe5de1ff7dedfc61727996ffa62a24b166093c9d75c2f340d2dd813d7cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d4fa155ad06444715f5bdd7c86b935b8c3a09c0161684a34c5242e209fd1395e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c831625dbd0f9e3494dc98ae61f4c722e508874473ed5dd3337e4d8b4a5ab8b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"de20c62aecea77c4f5b388cd06473e104621178deb4cf0c778e9e6a0dab0b2b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"0d9d3be3564a3100151a6e1ae1951f13156c7a924c22d306d33ed599169b3a8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6318789fe768d7c7c1bf509753a4278019fd033bf3264acfc3fdfb4736e405a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"550b741ebc8392a9c41d86bad794dfa1dac3e217cf38ae211b94ad3b460cf816\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"d4f9476e079c86438a3e70bf00658c15da54d5affac927aca709f2a5a28a2856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"6d90fbb4b52441d45d1af633f0a5a1c7f4fdaac2beb5a19b805c85ac96e9ced5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c5a1feb40731a163ade82e9f405b4d8dd54e59a876cebd6035483ebf43d073ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"5addad89ee48bb5ebc2fff94e068612b169a0543cf684ef8f91e03839a6b46aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"dd4e834b7175a5cf901f9c385d7d10e6783ec3856021a2d78890f5df8fd3d860\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"83d997eaacfd09bfc29a6f839961259fc137d16701d722788b8af24072a60cf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"602faff5ecaf80d48ceedcb6660ff57225a35d1a81dfd16de6c23c17b2c58e1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2559fbf0028a5ba78bd30825f90d521639e7efcff44897276d57ea397c3521d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"00dd40de0fd03d4c4e442d21a39cc29666a793e485c24257ae6f5865d8dcafeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"fb609aa5491ba907805d2d8a79e6fd486398e0af827f29290c8550c4de9cc08b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"66a3a3221e645480d16e899f2ee66a0f903d082d098085ea6eb7cea5646a9a4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1eb7897d87b8324e162e8c157b519a2453ebc40421c65a5fb6b6cf3a99da37bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"47f2d0dad0904e4754a31b56bc3996015000d246a651cd7ae8a0c11a13c46d29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"16ce1f8437f72a646ef479dfa8d9081aab6a8d15639d9a41302d1dcaeb83d480\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8a9aa2912542895fd0b2c1620fbbff56d6354a0244b869584a9421322d58549a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"65ca4d1635580c50567fead06bf8ddc00121f26e3c1b0af3588da26caa4031e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"d08fc10d786223e68c46b2831514aa962b8e810b48bce7c290fd5a9dc946e0c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"afe3e4fd6498dd752c1408d44d697c78067d9cfca49b8e17c957f1107bd29159\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7b5707c55f4a831b6c40c8de714355dc37f0769f3d01e3ab63089a574a5e90c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"c60828ca16ef84b7a5f682d52ef03cede85f017663e62fb9fbc0ad772dfd2ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b80f6cef2e969c1f008570634a903912fbb963e02b61fcd3d6eabc96e4d7e660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"ec22cae50a0d141359a788b23404a1b87020873e849f1c7f2821e4f4f589819f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"ea3f4ea4acf30bd44f150de33dd1c53f56bd31e718ea55da79b359501ae332ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"87ebeaa6eb266e52a2aeeffb20a6bfec05537473569fb827a1c21b7f4278a033\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fa7d0d6f93c4fe7b3a94fcb94afd6da2ab83b0ea6d135aa71da22c34993718e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"37cdaebbb9459c785c9575c5ac0f286daad6ed4c5aed53dddcc7bc477a218575\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c37f853416f0a9352736127603b1f84bc1be9730f83da4fc8da4e0aedf2c07e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"aab6da24089d86ef6744750ec37e3ae4ae54a659206c3db678eda83f7331c625\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e7cdfdfbf54424223419f523f1a4eb07195319bff0df2592a923437be7e0ddf9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d42d6ef898b5bb2f53c8be14ffeee02d873488450136c9cde9672f67f8b5db65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c256fd8bd371bcd3200dceaa60a34fd91fbe5b36d1fd2ec991ebc2490e9630a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7511c9e343a4a77a350a8f490a05d514a7fb3a7c49cba5959a484dff97a8d826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"bdd2a7ea22d1e652493a5199df68b6469e1d56e9f4cecd5730da55663f4ae048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-58b06e"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:09.630Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-6"},"creationTimestamp":"2026-11-04T00:22:29Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0","namespace":"kuadrant-system","resourceVersion":"48770","uid":"b84c4da0-fe51-4c37-bfc6-9644226c1b29"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:09.649Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-18f9ee","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-api-a-18f9ee","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-18f9ee","uid":"c90b69e5-1018-4c77-917c-452e4657409c"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-18f9ee-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]}],\"name\":\"aa7719226abfecb74935d9bd6490c90514acc3fd360bd696db3947d6e43b6ebe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-18f9ee-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]}],\"name\":\"69535c3cb29f1aca8461bc9fe5b3802c4910b2017dc2892615bb55f8e2d1d54b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-18f9ee-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]}],\"name\":\"5c7a06c67108b65707eebd41b14aad07b5f82214dbefb57c4301f13f55acf78f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-18f9ee-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]}],\"name\":\"9b1490bd08b7630b40db548a9dfb60e441f9badd85323313b452bfa6e4dd0e80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-18f9ee-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]}],\"name\":\"801cbc3d36a2b8866b1e8c6b3f12e7ce3f20e03a5742ab21dd5fa42aec07e57d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-18f9ee-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__7365d9d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-a-18f9ee\"]}],\"name\":\"857493e71cf2b0364435c7230ae50068896ba9c78ce2b85fd86ef567d4d425b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-18f9ee"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-18f9ee\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:09.696Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-4"},"creationTimestamp":"2026-11-04T00:22:29Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:30Z"}],"name":"0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79","namespace":"kuadrant-system","resourceVersion":"48690","uid":"419be679-a80b-4d88-861c-6625c51361ed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:09.769Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:09.839Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:09.912Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.015Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.089Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.157Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-2"},"creationTimestamp":"2026-11-04T00:22:30Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:31Z"}],"name":"8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f","namespace":"kuadrant-system","resourceVersion":"48744","uid":"8eaafe42-b5a5-4d7d-8da4-608bdef21327"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:10.230Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.302Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.378Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.450Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.524Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.592Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-1"},"creationTimestamp":"2026-11-04T00:22:28Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:28Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:29Z"}],"name":"fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa","namespace":"kuadrant-system","resourceVersion":"48661","uid":"9d2dda2d-8820-4864-adeb-05b08c554430"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:29Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:29Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:10.662Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.728Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-3"},"creationTimestamp":"2026-11-04T00:22:28Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:28Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:29Z"}],"name":"2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275","namespace":"kuadrant-system","resourceVersion":"48667","uid":"57e3df52-f469-4258-9092-52d7f9d2cb02"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:29Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:29Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:10.800Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.872Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:10.940Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-af2b39#rule-5"},"creationTimestamp":"2026-11-04T00:22:29Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"}],"name":"84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401","namespace":"kuadrant-system","resourceVersion":"48665","uid":"8d5b885c-d61b-4d87-a89f-fd600503e48c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-af2b39.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:29Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:29Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:11.010Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590\" already exists"}
{"level":"error","ts":"2026-11-04T00:23:11.156Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-af2b39-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-af2b39-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:11.410Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-58b06e-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w2-58b06e-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:11.478Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-edf87d31-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-edf87d31-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:11.546Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-ac96ab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-ac96ab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:11.681Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-18f9ee-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-18f9ee-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:11.751Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-ac96ab","namespace":"openshift-ingress","uid":"e1744b27-ca7e-4951-b76a-647c72ba65e2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-ac96ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:11.871Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-18f9ee","namespace":"openshift-ingress","uid":"14fd0685-afef-41a8-8fe9-e58ac121e576","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-18f9ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:12.298Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-af2b39","namespace":"openshift-ingress","uid":"df02ee72-4766-4b77-9fda-5105f3e2e18c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-af2b39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:23:12.420Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:12.420Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:23:12.485Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-a-18f9ee","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-a-18f9ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:12.776Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:12.900Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-18f9ee","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-18f9ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:12.909Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-58b06e-kserve-route","namespace":"e2e-models-e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w2-58b06e-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:23:13.090Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-676aa1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-676aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:23:20.066Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","EnvoyFilter","Limitador","ConfigMap"],"eventTypes":{"create":22,"update":22}}
{"level":"info","ts":"2026-11-04T00:23:20.429Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:22.248Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:23:22.451Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:23:22.451Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:25.452Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:23:25.459Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:25.459Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:25.461Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:25.513Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:23:25.518Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:23:25.689Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:28.158Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:28.158Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:36.172Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","HTTPRoute","TokenRateLimitPolicy","AuthConfig","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":12,"update":8}}
{"level":"info","ts":"2026-11-04T00:23:36.564Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:38.250Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:23:38.442Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:23:38.442Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:41.256Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:23:41.265Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:41.265Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:41.313Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:41.313Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:23:41.319Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:23:41.319Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:23:42.818Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-18f9ee-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-18f9ee-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:23:44.001Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:44.001Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:47Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-676aa1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-676aa1","reconcileID":"c4dffeec-9c81-469a-b417-0b70d9d476e8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-676aa1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:23:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-676aa1","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:23:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:23:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:23:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:23:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:23:48Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-676aa1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-676aa1","reconcileID":"9e028b29-b596-43f6-beb4-36dbd89109ee","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-676aa1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:23:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-676aa1","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:23:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:23:48Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:23:48Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:23:48Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:23:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:23:55.361Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","TokenRateLimitPolicy","Gateway","ConfigMap","Kuadrant","Limitador","AuthPolicy"],"eventTypes":{"create":3,"update":22}}
{"level":"info","ts":"2026-11-04T00:23:55.663Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:55.683Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:23:58.438Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:23:58.514Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:23:58.529Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:23:58.633Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:23:58.633Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:01.741Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:24:01.744Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:01.752Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:24:01.757Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:24:01.763Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:01.763Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:01.910Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:24:05.087Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-ac96ab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-ac96ab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:24:05.840Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:05.840Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:07.192Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","AuthPolicy"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-04T00:24:07.444Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:07.464Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:09.826Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:09.942Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:24:10.138Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:24:10.138Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:10.138Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:24:13.362Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:24:13.366Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:13.374Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:24:13.374Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:13.375Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:24:13.413Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:13.413Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:24:13.425Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-676aa1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-b-676aa1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-676aa1","uid":"13701bac-ade1-4f9b-8fde-7cd32117270c"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-676aa1"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-b-676aa1\" already exists"}
{"level":"error","ts":"2026-11-04T00:24:13.490Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118\" already exists"}
{"level":"error","ts":"2026-11-04T00:24:13.622Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2\" already exists"}
{"level":"error","ts":"2026-11-04T00:24:13.714Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc\" already exists"}
{"level":"error","ts":"2026-11-04T00:24:13.791Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6\" already exists"}
{"level":"error","ts":"2026-11-04T00:24:13.861Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d","namespace":"kuadrant-system","resourceVersion":"48766","uid":"5f68bc60-7da1-47f8-b053-3903ada4208a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:13.926Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9","namespace":"kuadrant-system","resourceVersion":"48778","uid":"31952ea8-4bf3-41af-8fc8-c170817aa285"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:13.993Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-6"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:59Z"}],"name":"500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464","namespace":"kuadrant-system","resourceVersion":"49585","uid":"e70c7941-e179-409b-89e9-5a04bed7db70"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.059Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c","namespace":"kuadrant-system","resourceVersion":"48772","uid":"1456a81c-0d28-40a1-9253-33667d4b53fb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.071Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-676aa1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-api-b-676aa1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-676aa1","uid":"13701bac-ade1-4f9b-8fde-7cd32117270c"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-676aa1-maas-auth\"]}],\"name\":\"ecb7b723ba2dae5c411c8cb5e62335d324040192f8fd585eedaa9ade9f3875cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-676aa1-maas-auth\"]}],\"name\":\"cc524f5051317fab87be9e414e4807b8c4cc69e26623415e4cd7ffaa749ae53c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-676aa1-maas-auth\"]}],\"name\":\"d4d58a5d4e1bae89be0fdb4bb0496184780c4a520f3cc202544cb043a647d783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-676aa1-maas-auth\"]}],\"name\":\"3f160cb708ba50cbb6c3313d870a4b79a86ee65def2c35bc9507b1c553ae86c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-676aa1-maas-auth\"]}],\"name\":\"75826ff61d0a8fee745dc3fb2d55b846c8b35e7b8901ab0ee37e3013c0b73c98\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-676aa1-maas-auth\"]}],\"name\":\"5399f2654ce9a4f147a750b9a39551948dfbd14d0c16d6a5ee59d7ffc387c9df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-676aa1"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-b-676aa1\" already exists"}
{"level":"error","ts":"2026-11-04T00:24:14.125Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:30Z"}],"name":"ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65","namespace":"kuadrant-system","resourceVersion":"48701","uid":"1a18ce00-def9-4a11-b2c0-e17fef228f3f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.196Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44\" already exists"}
{"level":"error","ts":"2026-11-04T00:24:14.261Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:21:36Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:30Z"}],"name":"27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f","namespace":"kuadrant-system","resourceVersion":"48694","uid":"e38112a5-1a00-4653-89de-b4ce8c083477"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.328Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56","namespace":"kuadrant-system","resourceVersion":"48788","uid":"d3d5f6bd-5d04-4638-a911-a72e42cabb37"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.397Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-3"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:01Z"}],"name":"aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c","namespace":"kuadrant-system","resourceVersion":"49709","uid":"6f14cfd9-c963-4470-b11b-98fb7137ce9f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.465Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-1"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:00Z"}],"name":"38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414","namespace":"kuadrant-system","resourceVersion":"49611","uid":"50899ba7-9ec5-42a9-9aab-4fded3bd5da5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.535Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-2"},"creationTimestamp":"2026-11-04T00:20:46Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"}],"name":"c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22","namespace":"kuadrant-system","resourceVersion":"48705","uid":"5200af56-cd79-469f-a0cd-51e9a1d47d09"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.600Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf","namespace":"kuadrant-system","resourceVersion":"48775","uid":"abbbc494-8868-4b3b-93e5-7d6a4057ef9b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.670Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-3"},"creationTimestamp":"2026-11-04T00:20:50Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:28Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:29Z"}],"name":"bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358","namespace":"kuadrant-system","resourceVersion":"48651","uid":"8c9e961b-41fd-48ad-8ff3-e07787d3df1a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.735Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03","namespace":"kuadrant-system","resourceVersion":"48785","uid":"5ac8316b-793f-4a9c-9724-6e988dd667ad"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.801Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-1"},"creationTimestamp":"2026-11-04T00:20:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"}],"name":"6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718","namespace":"kuadrant-system","resourceVersion":"48672","uid":"24894a84-c41c-42e7-88a9-566249af4195"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.868Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-4"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:00Z"}],"name":"98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5","namespace":"kuadrant-system","resourceVersion":"49632","uid":"e25192e7-03d7-47c6-abd0-f45f279c2f61"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:14.934Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-6"},"creationTimestamp":"2026-11-04T00:20:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:31Z"}],"name":"eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010","namespace":"kuadrant-system","resourceVersion":"48751","uid":"54f87341-414c-44cc-b631-5b4c103b03ce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.001Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-4"},"creationTimestamp":"2026-11-04T00:20:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f","namespace":"kuadrant-system","resourceVersion":"48761","uid":"ebfd0e48-0480-4b86-a580-4c1fda702325"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.067Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:30Z"}],"name":"6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74","namespace":"kuadrant-system","resourceVersion":"48696","uid":"8782b45a-ca81-44c2-bb5c-04aa90172c51"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.133Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:21:36Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"}],"name":"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a","namespace":"kuadrant-system","resourceVersion":"48680","uid":"e8e7a723-fb59-4b9c-b834-fb55aec20839"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:37Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:37Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.198Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b","namespace":"kuadrant-system","resourceVersion":"48756","uid":"5f3de749-6b01-4d76-9b44-6749cad05bbe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.266Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-edf87d31/e2e-lifecycle-model-edf87d31-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:21:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:32Z"}],"name":"c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648","namespace":"kuadrant-system","resourceVersion":"48783","uid":"7ecb0ae9-2ca1-4ae2-9d3f-d308ba30791e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.333Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-edf87d31#rule-5"},"creationTimestamp":"2026-11-04T00:20:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:30Z"}],"name":"913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba","namespace":"kuadrant-system","resourceVersion":"48703","uid":"81a72254-4fbe-4d4d-b840-8ab32d6f90d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-edf87d31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.398Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-5"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:00Z"}],"name":"908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590","namespace":"kuadrant-system","resourceVersion":"49698","uid":"387b34f0-b7b5-4df3-a342-29ad58fa173c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.463Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-2"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:01Z"}],"name":"d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8","namespace":"kuadrant-system","resourceVersion":"49705","uid":"5f162e57-d35e-47d2-9c09-eb43243d4d73"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.534Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7\" already exists"}
{"level":"error","ts":"2026-11-04T00:24:15.672Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.731Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-af2b39","namespace":"openshift-ingress","uid":"df02ee72-4766-4b77-9fda-5105f3e2e18c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-af2b39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.763Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-18f9ee-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-18f9ee-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.790Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.849Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.906Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-676aa1","namespace":"openshift-ingress","uid":"148e460b-bf6c-4821-97fa-79f7561749a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-676aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:15.965Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-lifecycle-model-edf87d31","namespace":"ai-tenant-e2e-mt-edf87d31","uid":"bb8798e2-90a2-47ec-9bfa-8e75b510b588","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-lifecycle-model-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.030Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.209Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.289Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-ac96ab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-ac96ab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.328Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.356Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-676aa1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-676aa1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.386Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.424Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-edf87d31-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-edf87d31-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.445Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.503Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-18f9ee","namespace":"openshift-ingress","uid":"14fd0685-afef-41a8-8fe9-e58ac121e576","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-18f9ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.623Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.745Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-ac96ab","namespace":"openshift-ingress","uid":"e1744b27-ca7e-4951-b76a-647c72ba65e2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-ac96ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.804Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.864Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:16.986Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:24:16.986Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:16.986Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:24:17.169Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-b-676aa1","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-b-676aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:17.503Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-676aa1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-676aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:24:25.229Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","HTTPRoute","EnvoyFilter","Gateway","AuthPolicy","ConfigMap","Limitador"],"eventTypes":{"create":10,"update":49}}
{"level":"info","ts":"2026-11-04T00:24:25.636Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:27.435Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:24:27.551Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:24:27.551Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:30.963Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:24:30.973Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:30.974Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:30.974Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:30.980Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:24:30.980Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:31.013Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:24:32.627Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-lifecycle-model-edf87d31","namespace":"ai-tenant-e2e-mt-edf87d31","uid":"bb8798e2-90a2-47ec-9bfa-8e75b510b588","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-lifecycle-model-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:24:33.509Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:24:34.076Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:34.076Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","reconcileID":"35ca962f-4628-4010-83e5-82410ab38240","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","reconcileID":"ddf045ef-86ac-419f-b6ef-85f53d70f56e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","reconcileID":"ddf045ef-86ac-419f-b6ef-85f53d70f56e"}
{"level":"error","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","reconcileID":"ddf045ef-86ac-419f-b6ef-85f53d70f56e","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-d3032c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:24:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","reconcileID":"6dde78f2-c105-4dd8-aef9-12c963c268f1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"69ca6828-26f8-4c7a-b039-dd3a1d004777","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"69ca6828-26f8-4c7a-b039-dd3a1d004777","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:24:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:24:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:24:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:24:43Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:24:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:24:43Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"d1db7643-b8b0-45b0-9c63-c871e6ec97c4","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-mt-edf87d31\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:24:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:24:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:24:43Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-mt-edf87d31\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:24:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:24:45.460Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","AuthPolicy","ConfigMap","EnvoyFilter"],"eventTypes":{"delete":1,"update":28}}
{"level":"info","ts":"2026-11-04T00:24:50.540Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:24:50.540Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:50.546Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:24:50.557Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:50.557Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:50.744Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:24:53.703Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-af2b39-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-af2b39-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:24:54.389Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:24:56.431Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Kuadrant","AuthPolicy","HTTPRoute","Gateway"],"eventTypes":{"create":3,"delete":3,"update":4}}
{"level":"info","ts":"2026-11-04T00:24:56.884Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:56.892Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:24:59.331Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:24:59.642Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:24:59.727Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:24:59.728Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:24:59.728Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","reconcileID":"cae88510-5fe1-435b-98de-a02decd0ebc4","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:25:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:25:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:25:03Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:25:03Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:25:03.469Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:03.514Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:25:03.515Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:25:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:25:03Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","reconcileID":"dd76ff2a-fc4a-416e-85cc-c5bbd08cec88","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:25:03.520Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:03.520Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:03.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:25:03.526Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-d3032c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-api-b-d3032c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-d3032c","uid":"6ca5de56-f997-4b73-8548-4b486fab2e4b"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-d3032c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-b-d3032c\" already exists"}
{"level":"info","ts":"2026-11-04T00:25:03Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","reconcileID":"dd76ff2a-fc4a-416e-85cc-c5bbd08cec88"}
{"level":"error","ts":"2026-11-04T00:25:03Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","reconcileID":"dd76ff2a-fc4a-416e-85cc-c5bbd08cec88","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-5a865b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:25:03Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","reconcileID":"4a7a232c-04a8-4354-a9ec-99d3f057c7dc","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:25:03.583Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-d3032c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-b-d3032c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-d3032c","uid":"6ca5de56-f997-4b73-8548-4b486fab2e4b"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-d3032c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-b-d3032c\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:03.585Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-1"},"creationTimestamp":"2026-11-04T00:24:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:02Z"}],"name":"b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118","namespace":"kuadrant-system","resourceVersion":"51321","uid":"90eda012-e98c-40e6-8c57-d75a5e1c3a42"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:03.618Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-mt-edf87d31","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:25:03.618Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:25:03.618Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:25:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:25:03.643Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-mt-edf87d31","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:25:03.685Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-2"},"creationTimestamp":"2026-11-04T00:24:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:04Z"}],"name":"e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44","namespace":"kuadrant-system","resourceVersion":"51411","uid":"7f4a9c0c-9787-476d-b0e5-7e6ba006d15a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:03.757Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7f3dfd72d821cd5ac42b13ed6aa6ed8dc31445ecf3d5fedc1315f0c837dfd736","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7f3dfd72d821cd5ac42b13ed6aa6ed8dc31445ecf3d5fedc1315f0c837dfd736"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7f3dfd72d821cd5ac42b13ed6aa6ed8dc31445ecf3d5fedc1315f0c837dfd736\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:03.828Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-5"},"creationTimestamp":"2026-11-04T00:24:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:03Z"}],"name":"b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc","namespace":"kuadrant-system","resourceVersion":"51382","uid":"bdce2fe7-8812-42d9-9279-d3d333fbfa7a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:03.933Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-3"},"creationTimestamp":"2026-11-04T00:24:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:03Z"}],"name":"95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6","namespace":"kuadrant-system","resourceVersion":"51396","uid":"59f18413-233c-45a5-b13c-b65320feb350"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:04.019Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-4"},"creationTimestamp":"2026-11-04T00:24:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:03Z"}],"name":"dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7","namespace":"kuadrant-system","resourceVersion":"51399","uid":"0f5826df-2d50-4437-94b2-e091cb074c9a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:04.096Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"92108f06f42c5147fe403a34e2e462e1c080fef48daece3d661608c5516649be","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92108f06f42c5147fe403a34e2e462e1c080fef48daece3d661608c5516649be"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"92108f06f42c5147fe403a34e2e462e1c080fef48daece3d661608c5516649be\" already exists"}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:25:04.218Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2787acfaeea1b4e70f25ad9a7f2aee442ac9d197db709b86b7d8756b4ccaede9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2787acfaeea1b4e70f25ad9a7f2aee442ac9d197db709b86b7d8756b4ccaede9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2787acfaeea1b4e70f25ad9a7f2aee442ac9d197db709b86b7d8756b4ccaede9\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:04.493Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-58b06e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4fcb948c-b646-4a79-81f0-c8c8b238ba80\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:32Z"}],"name":"kuadrant-e2e-worker-w2-58b06e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-58b06e","uid":"4fcb948c-b646-4a79-81f0-c8c8b238ba80"}],"resourceVersion":"52069","uid":"732b86e6-fa81-4635-acf0-7deb37d6eb21"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"e146aba91e806fec4ad460501c64f088e7918b3c7df4adc5b88bc6c3faf2ac37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"9dc9d9cec315591800c88f4289e106e101bea3f744c5b9e8db2e7bee888f56d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"63ec76d05da6d8eb8438f4440655f88e11dac33ecc007fa0c01af712b41e570a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"602b24d85c40ef1424ba4360695cdf69f8ff19714c62cbcceab51ed74fdbb3c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"91ef8a3906f365286d0019bcfbefc55ed221a2b34a354423d7e5aabecdfc1e41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fe787d97dad775e52b0925cb3b1fc11a2cccc1c1d01be7803ffa54e7a5c34f04\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7518d66fa47f7f6cabe6c14b9e1911316826c977ac3ad6142125da82716ee49d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dc090a0b1fa64108101227bd0e9b3c7a256183d61df5facdc28601f35312d1b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2a2f0db09cb2fb6f2f7fb7aae81d3230cdc54b055d10cab642b30512426ad32e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"a264fddac0eede3bb186a56c3d99c2c84f52da822bfe449896c63e80d378fa6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"975ea7be7a86f3bd7fd50267137f6de8065399993c7f63b59c191559e47f793b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"0550d6c99a9c75642299947f71e362196d9b4abf2094d7e3ae1dc4c1153628b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"a95a55523a043ed134414c098458e5a7d6983ab83c6259ae31d9d5fa9a8316c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5cf451c78d8f4be30e60bba48086bdc4cf8200cc3ebdbab4eb91c0d2d9e57068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6118193c4ed945f459e205e00e6416c96e49516833c47b89d6ab4cf069c93dd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1d7028f009a317db8afd1e93862135d0f18f2de709aa112b26db637814fd6ef1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"1369d79269306e5fa8bcaf6aa97220019e84961c9b6a9afc7b7b263f0ecb49b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"2480cdb507fa123566b39943d7f0d47eaddf130eba838a9db19503d4f513a022\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"9bc8ba0637406af8bf8245d440db5a33901d9b4f5074b872b15869bdd6287a09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"2124069b6a0d920b738a13569de3259650e6753b0f67ccee6180a5cae31b4c5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6ace09d0808b0cc3ec8485b92185031610ea8a5f271f1d1b8533399d7cd3c81f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c74893123203fae1ad8050e640815fae46cdb7fde29ebfbefa3b6065bc0b820d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5c2c66b930801af0fcd5415e60c1646e4cd4d22f4cab4c51bdb2f5aa9db1a342\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7b596cdf84908424c0234d4546947508d061e01a9490fddfb346ada7a88d98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"567d9ef227a1b0e29d280dbfeb4eacab7843c88000a805f0ef359193c69a8189\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e40f041bd75dbf3b0658d7a49adba76e80113241cee931f90f0c37a1149955ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8713cb237dc57b8e8ced66f8cbc11fc7c18b377af9e36c0138a053141e4df20b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"ce3567b64c376474041ae5a790ea350039c7b065c373d3bc82afe2a18645e225\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"8a3503393c3e9bb4af6707deccbd9de501af9ca64c00bce65971025fe6d62c10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"053fe182975a90257bc91bb8a5ba18938a225856a6ec12e179a0dc901e82026c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6ed13fe5de1ff7dedfc61727996ffa62a24b166093c9d75c2f340d2dd813d7cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dad0c6ed4987ed315608a951935eb320ea90d0b7236754a5f14c216e2672149f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d4fa155ad06444715f5bdd7c86b935b8c3a09c0161684a34c5242e209fd1395e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d255f6849f684d6e9c587b3f81919950ca9931063d04bd20d428877e38cf32bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c831625dbd0f9e3494dc98ae61f4c722e508874473ed5dd3337e4d8b4a5ab8b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"de20c62aecea77c4f5b388cd06473e104621178deb4cf0c778e9e6a0dab0b2b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"0d9d3be3564a3100151a6e1ae1951f13156c7a924c22d306d33ed599169b3a8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"41be2b2d382e17f0d6fb6346c55ba1c2a1df17a426cfc91098af388907da6123\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6318789fe768d7c7c1bf509753a4278019fd033bf3264acfc3fdfb4736e405a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"550b741ebc8392a9c41d86bad794dfa1dac3e217cf38ae211b94ad3b460cf816\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b5a2bfa9c376e074f9d1a5fc1e74b4b8f2be7b2443cee6dc093b54b277b61812\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"d4f9476e079c86438a3e70bf00658c15da54d5affac927aca709f2a5a28a2856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"6d90fbb4b52441d45d1af633f0a5a1c7f4fdaac2beb5a19b805c85ac96e9ced5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b37b3c55782fc38e56fc7c8f891c162219d3ceb3cd7f0a4c2a524ec50e8161da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c5a1feb40731a163ade82e9f405b4d8dd54e59a876cebd6035483ebf43d073ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"5addad89ee48bb5ebc2fff94e068612b169a0543cf684ef8f91e03839a6b46aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"dd4e834b7175a5cf901f9c385d7d10e6783ec3856021a2d78890f5df8fd3d860\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"83d997eaacfd09bfc29a6f839961259fc137d16701d722788b8af24072a60cf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"602faff5ecaf80d48ceedcb6660ff57225a35d1a81dfd16de6c23c17b2c58e1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4fc416c6b94554b03be40292dd34bbe7f23edf74b3de1f2650f9cd17dc8c8dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2559fbf0028a5ba78bd30825f90d521639e7efcff44897276d57ea397c3521d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"00dd40de0fd03d4c4e442d21a39cc29666a793e485c24257ae6f5865d8dcafeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"93acb8e543c3570b87a029840646c64ab84aba25460ef6fde7be10e83afaefef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"fb609aa5491ba907805d2d8a79e6fd486398e0af827f29290c8550c4de9cc08b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"66a3a3221e645480d16e899f2ee66a0f903d082d098085ea6eb7cea5646a9a4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1eb7897d87b8324e162e8c157b519a2453ebc40421c65a5fb6b6cf3a99da37bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"47f2d0dad0904e4754a31b56bc3996015000d246a651cd7ae8a0c11a13c46d29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7e1eb9dec290fe93db72581dd65bd5fd27cc167d1e8123fc32d61e49b3882af0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"16ce1f8437f72a646ef479dfa8d9081aab6a8d15639d9a41302d1dcaeb83d480\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8a9aa2912542895fd0b2c1620fbbff56d6354a0244b869584a9421322d58549a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"3dcd0c3947e33253b1421b74217847eed8f5dad1afe3feda1a3f46868bb89d5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"65ca4d1635580c50567fead06bf8ddc00121f26e3c1b0af3588da26caa4031e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"d08fc10d786223e68c46b2831514aa962b8e810b48bce7c290fd5a9dc946e0c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4652f8a2150a4931901a27c005b2bb44d4d7d1212b652ba25bff4887be9a061d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"afe3e4fd6498dd752c1408d44d697c78067d9cfca49b8e17c957f1107bd29159\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7b5707c55f4a831b6c40c8de714355dc37f0769f3d01e3ab63089a574a5e90c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"c60828ca16ef84b7a5f682d52ef03cede85f017663e62fb9fbc0ad772dfd2ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b80f6cef2e969c1f008570634a903912fbb963e02b61fcd3d6eabc96e4d7e660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"ec22cae50a0d141359a788b23404a1b87020873e849f1c7f2821e4f4f589819f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8011907f4913a9f005064fa089a9485c460a80b7297b4e7706c2794bced53adb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"ea3f4ea4acf30bd44f150de33dd1c53f56bd31e718ea55da79b359501ae332ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"87ebeaa6eb266e52a2aeeffb20a6bfec05537473569fb827a1c21b7f4278a033\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fa7d0d6f93c4fe7b3a94fcb94afd6da2ab83b0ea6d135aa71da22c34993718e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"37cdaebbb9459c785c9575c5ac0f286daad6ed4c5aed53dddcc7bc477a218575\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c37f853416f0a9352736127603b1f84bc1be9730f83da4fc8da4e0aedf2c07e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"aab6da24089d86ef6744750ec37e3ae4ae54a659206c3db678eda83f7331c625\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e7cdfdfbf54424223419f523f1a4eb07195319bff0df2592a923437be7e0ddf9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d42d6ef898b5bb2f53c8be14ffeee02d873488450136c9cde9672f67f8b5db65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c256fd8bd371bcd3200dceaa60a34fd91fbe5b36d1fd2ec991ebc2490e9630a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7511c9e343a4a77a350a8f490a05d514a7fb3a7c49cba5959a484dff97a8d826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"bdd2a7ea22d1e652493a5199df68b6469e1d56e9f4cecd5730da55663f4ae048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"66c1d0d7977e242c1ab5ab2e30c9e5d38016fdb4efbc086cfe61f11b43028d1f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-58b06e"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:04.506Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-676aa1#rule-6"},"creationTimestamp":"2026-11-04T00:24:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:02Z"}],"name":"ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2","namespace":"kuadrant-system","resourceVersion":"51363","uid":"3b6a9611-8297-4b23-87e7-7299a933e526"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-676aa1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:04.576Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0a85549e2e8eaa24cf84f340e0ceeb8abead9f3c09cb6d25f65f51ff1b7aa2e6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0a85549e2e8eaa24cf84f340e0ceeb8abead9f3c09cb6d25f65f51ff1b7aa2e6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0a85549e2e8eaa24cf84f340e0ceeb8abead9f3c09cb6d25f65f51ff1b7aa2e6\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:04.649Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f73a77de8285e743fe25877ce101aa4f57768e256989a0cf2dcefc8096ff2715","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f73a77de8285e743fe25877ce101aa4f57768e256989a0cf2dcefc8096ff2715"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f73a77de8285e743fe25877ce101aa4f57768e256989a0cf2dcefc8096ff2715\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:04.730Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0311060b5b473e7633fdd4a161794f37edb03ede4f886372d03bee99db421048","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0311060b5b473e7633fdd4a161794f37edb03ede4f886372d03bee99db421048"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-d3032c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0311060b5b473e7633fdd4a161794f37edb03ede4f886372d03bee99db421048\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:04.791Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03","error":"authconfigs.authorino.kuadrant.io \"42f8082474d9c99f731c1df4f099f137211611798fd5d471bec35d4a8d86ce03\" not found"}
{"level":"error","ts":"2026-11-04T00:25:04.845Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56","error":"authconfigs.authorino.kuadrant.io \"fd2383e532f20460363ac4848adae1d28d766dcb5495fa79b4a149e2d3110e56\" not found"}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:25:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:25:04.853Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-d3032c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-api-b-d3032c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-d3032c","uid":"6ca5de56-f997-4b73-8548-4b486fab2e4b"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f73a77de8285e743fe25877ce101aa4f57768e256989a0cf2dcefc8096ff2715\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-d3032c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]}],\"name\":\"d307fc42fe60ce8f7cb1a3225c8ec39cc1f45f7e4d9b48445323cbd78ce1acb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2787acfaeea1b4e70f25ad9a7f2aee442ac9d197db709b86b7d8756b4ccaede9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-d3032c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]}],\"name\":\"9220f0932eaaa90b243ba01ff32a72aa6117f72587e46cf64c9cc957c6b0d2d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92108f06f42c5147fe403a34e2e462e1c080fef48daece3d661608c5516649be\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-d3032c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]}],\"name\":\"f1e712681e9cd55950363439a5ebca6b71498360e86a74d869538e2c27691db3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0311060b5b473e7633fdd4a161794f37edb03ede4f886372d03bee99db421048\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-d3032c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]}],\"name\":\"b3f2ec9f71bfcf888b5e69b3c54a24c281155090dc86c6881bbc8f737b190e5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a85549e2e8eaa24cf84f340e0ceeb8abead9f3c09cb6d25f65f51ff1b7aa2e6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-d3032c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]}],\"name\":\"535fa4eb96f3258715f33d90361ebaff36aabaaef2842f04bb5420722d908705\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f3dfd72d821cd5ac42b13ed6aa6ed8dc31445ecf3d5fedc1315f0c837dfd736\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-d3032c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ca3537fe\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-d3032c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-d3032c\"]}],\"name\":\"9de38d35ea62505de18b053ab69dc340cf42017fd2fd88a5b74d3347179c1257\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-d3032c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-b-d3032c\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:04.900Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b","error":"authconfigs.authorino.kuadrant.io \"30955948f02c9bee1c3c8296eb8e30520a36c76ac4918803201361d58930ef6b\" not found"}
{"level":"error","ts":"2026-11-04T00:25:04.954Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9","error":"authconfigs.authorino.kuadrant.io \"b339e2a136d614527fe4092a2b1101b96c0dd507f329ebaa64980c8d68cc78e9\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.014Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010","error":"authconfigs.authorino.kuadrant.io \"eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.022Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-mt-edf87d31","envoyfilter":"openshift-ingress/kuadrant-e2e-mt-edf87d31","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.068Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65","error":"authconfigs.authorino.kuadrant.io \"ea19b2633ee6dbf73e2637701fbe752675b7cc9f70f418bce3c94b7805860a65\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.124Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf","error":"authconfigs.authorino.kuadrant.io \"ab3590c5dd7e8a87cc5a836e25da6ee03ff591a339d66ac7fdbd5d8440f312bf\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.181Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648","error":"authconfigs.authorino.kuadrant.io \"c11ab1e11a8e03f9ad110060267798af084fbb44b7312034afe1683023877648\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.238Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718","error":"authconfigs.authorino.kuadrant.io \"6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.293Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358","error":"authconfigs.authorino.kuadrant.io \"bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.348Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22","error":"authconfigs.authorino.kuadrant.io \"c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.403Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f","error":"authconfigs.authorino.kuadrant.io \"27f302f6ed41aa927b2052e0144c6cb3fec35d32456e7b439cd8a0d2928ec59f\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.458Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f","error":"authconfigs.authorino.kuadrant.io \"eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.513Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d","error":"authconfigs.authorino.kuadrant.io \"1b1147861d381d4f0034fe63d75a833971fa4301fc9d7651b08fbfc22fb75c2d\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.568Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c","error":"authconfigs.authorino.kuadrant.io \"bab40a2a016626c01b59838969e7a1858dcea85736c56396b16961401accf90c\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.623Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba","error":"authconfigs.authorino.kuadrant.io \"913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.678Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a","error":"authconfigs.authorino.kuadrant.io \"1960dba3a15782aba9658b139979ae0874ff3b92d49fb0bd54e65282ccf39c8a\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74","error":"authconfigs.authorino.kuadrant.io \"6669a3c1a5aea695d6214acf575b0b832933e05dccc8627ce4f1a66d777ebd74\" not found"}
{"level":"error","ts":"2026-11-04T00:25:05.794Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-18f9ee","namespace":"openshift-ingress","uid":"14fd0685-afef-41a8-8fe9-e58ac121e576","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-18f9ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:05.804Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-af2b39-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-af2b39-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:05.918Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:05.988Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-ac96ab","namespace":"openshift-ingress","uid":"e1744b27-ca7e-4951-b76a-647c72ba65e2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-ac96ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.088Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.126Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-676aa1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-676aa1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.166Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.195Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-d3032c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-d3032c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.230Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.291Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.350Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-ac96ab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-ac96ab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.358Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.418Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-d3032c","namespace":"openshift-ingress","uid":"478850ab-690f-425e-8e92-762c89199df5","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-d3032c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.665Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.793Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.852Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-676aa1","namespace":"openshift-ingress","uid":"148e460b-bf6c-4821-97fa-79f7561749a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-676aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.913Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:06.976Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:07.039Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:07.161Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:07.225Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-af2b39","namespace":"openshift-ingress","uid":"df02ee72-4766-4b77-9fda-5105f3e2e18c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-af2b39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:25:07.226Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:07.226Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:25:07.367Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-5a865b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-5a865b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:07.573Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-b-d3032c","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-b-d3032c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:07.690Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-lifecycle-model-edf87d31-kserve-route","namespace":"ai-tenant-e2e-mt-edf87d31","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-lifecycle-model-edf87d31-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:07.786Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-d3032c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-d3032c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:08.040Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-edf87d31","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","reconcileID":"e5513857-feca-4bba-b22b-b1b44ae1a046","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","reconcileID":"e5513857-feca-4bba-b22b-b1b44ae1a046","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-af2b39","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-af2b39","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-a-af2b39\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:25:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:25:21.074Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","EnvoyFilter","Gateway","ConfigMap","HTTPRoute","Kuadrant","AuthPolicy","Limitador"],"eventTypes":{"create":12,"delete":21,"update":36}}
{"level":"info","ts":"2026-11-04T00:25:21.613Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:21.576Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:24.226Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:25:24.433Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:25:24.433Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:24.433Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:25:24.516Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:27.671Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:25:27.675Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:27.680Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:25:27.682Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:27.682Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:27.689Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:25:27.844Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:25:27.844Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-api-a-af2b39","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-af2b39\" not found"}
{"level":"error","ts":"2026-11-04T00:25:27.934Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-api-a-af2b39","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-af2b39\" not found"}
{"level":"error","ts":"2026-11-04T00:25:28.454Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-api-a-af2b39","envoyfilter":"openshift-ingress/kuadrant-e2e-api-a-af2b39","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-af2b39\" not found"}
{"level":"error","ts":"2026-11-04T00:25:29.401Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-af2b39-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-a-af2b39-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T00:25:30.919Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:30.919Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:25:31.316Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-af2b39","error":"gateways.gateway.networking.k8s.io \"e2e-api-a-af2b39\" not found"}
{"level":"info","ts":"2026-11-04T00:25:32.372Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"create":1,"delete":2,"update":2}}
{"level":"info","ts":"2026-11-04T00:25:32.762Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:32.783Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:35.451Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:25:35.532Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:35.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:25:35.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:35.913Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:25:38.779Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:25:38.779Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:38.824Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:25:38.825Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:25:38.827Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:38.827Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:25:38.873Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-5a865b","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-b-5a865b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-5a865b","uid":"b84ba5ae-1f21-4e7f-b7a6-69c96a982993"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-5a865b"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-b-5a865b\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:38.878Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-5a865b","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-api-b-5a865b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-5a865b","uid":"b84ba5ae-1f21-4e7f-b7a6-69c96a982993"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-5a865b"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-b-5a865b\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:38.931Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-api-a-af2b39","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-af2b39\" not found"}
{"level":"error","ts":"2026-11-04T00:25:38.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:25:38.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:25:38.943Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f3d25405c0865a1d598be1b2b16f291e76078b760bfc7e8e5cc2be6be5e2e111","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f3d25405c0865a1d598be1b2b16f291e76078b760bfc7e8e5cc2be6be5e2e111"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f3d25405c0865a1d598be1b2b16f291e76078b760bfc7e8e5cc2be6be5e2e111\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:38.980Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-api-a-af2b39","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-af2b39\" not found"}
{"level":"error","ts":"2026-11-04T00:25:39.018Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cfa664eb143e24e992179ee50e7d1689c76b73270f352e3fa59400b841203fa8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cfa664eb143e24e992179ee50e7d1689c76b73270f352e3fa59400b841203fa8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cfa664eb143e24e992179ee50e7d1689c76b73270f352e3fa59400b841203fa8\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:39.091Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9f093c9d7c079bb407fdaa7ef8358dd620e03f9387d3ec650a696196ca2fa1d7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f093c9d7c079bb407fdaa7ef8358dd620e03f9387d3ec650a696196ca2fa1d7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9f093c9d7c079bb407fdaa7ef8358dd620e03f9387d3ec650a696196ca2fa1d7\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:39.163Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2ab6078723b13af9190597ec0a7fe0e887e225d977740d9802500d57be8d51f3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ab6078723b13af9190597ec0a7fe0e887e225d977740d9802500d57be8d51f3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2ab6078723b13af9190597ec0a7fe0e887e225d977740d9802500d57be8d51f3\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:39.234Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0af9c2d321369f409df44ead8a2ab44b4d370c9581f0d67b5438bca058c54199","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0af9c2d321369f409df44ead8a2ab44b4d370c9581f0d67b5438bca058c54199"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0af9c2d321369f409df44ead8a2ab44b4d370c9581f0d67b5438bca058c54199\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:39.340Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"01fd5e4cfcfac54eec45ad9fde4111f8314b443f3b837472c59daba492772f6b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01fd5e4cfcfac54eec45ad9fde4111f8314b443f3b837472c59daba492772f6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"01fd5e4cfcfac54eec45ad9fde4111f8314b443f3b837472c59daba492772f6b\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:39.413Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275","error":"authconfigs.authorino.kuadrant.io \"2b4e8bc5eaaabb84d7bbd64225ca666614ea71e065c6d18f7acef0a87bc82275\" not found"}
{"level":"error","ts":"2026-11-04T00:25:39.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f","error":"authconfigs.authorino.kuadrant.io \"8ceb8bf60f28e3d1275cb7d8492811c16e8eaf65f4c010c24a5c7ff6104a075f\" not found"}
{"level":"error","ts":"2026-11-04T00:25:39.500Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-api-a-af2b39","envoyfilter":"openshift-ingress/kuadrant-e2e-api-a-af2b39","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-af2b39\" not found"}
{"level":"error","ts":"2026-11-04T00:25:39.525Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0","error":"authconfigs.authorino.kuadrant.io \"6d58bc1432b8a01571dc7e1796652d573da69e40b8a792bfcfb01cc4811ff9b0\" not found"}
{"level":"error","ts":"2026-11-04T00:25:39.579Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa","error":"authconfigs.authorino.kuadrant.io \"fb09435fac6aabe350d497e4f3728ec41fe96dcdaca8c12511a69ddb5ff43cfa\" not found"}
{"level":"error","ts":"2026-11-04T00:25:39.623Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-5a865b","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-api-b-5a865b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-5a865b","uid":"b84ba5ae-1f21-4e7f-b7a6-69c96a982993"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01fd5e4cfcfac54eec45ad9fde4111f8314b443f3b837472c59daba492772f6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"9ea7a714de9c05c8446f623862d225fcbb6b5389d1556380d17f44054a79d01b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cfa664eb143e24e992179ee50e7d1689c76b73270f352e3fa59400b841203fa8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"19994d22408fa52301332c77ec4522366459e08ca2fdeadf635f08500b1b2254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0af9c2d321369f409df44ead8a2ab44b4d370c9581f0d67b5438bca058c54199\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"85dda71cc686b196ca164123a20015d22c5d46ec1c2bbee53420c935127cd660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3d25405c0865a1d598be1b2b16f291e76078b760bfc7e8e5cc2be6be5e2e111\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"1d71d56974f179a07000dc26299ced9a1d29d277c1b6b7068f3a11128017d1f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab6078723b13af9190597ec0a7fe0e887e225d977740d9802500d57be8d51f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"5d4a54c29302fb73e2cc1850bd074884590c0fd474acaca13c1beda0130b72a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f093c9d7c079bb407fdaa7ef8358dd620e03f9387d3ec650a696196ca2fa1d7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"18c409e0c7a2d4bf507fd1cc6cb2c657326fdb3c23e659cea7fabea7d024f0ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-5a865b"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-b-5a865b\" already exists"}
{"level":"error","ts":"2026-11-04T00:25:39.634Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401","error":"authconfigs.authorino.kuadrant.io \"84e39d6987041cb80cd36aab8d762c8f75b949931975fb6993ca2cc3bc289401\" not found"}
{"level":"error","ts":"2026-11-04T00:25:39.688Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79","error":"authconfigs.authorino.kuadrant.io \"0fa4e77252710eca40c11dd6dea1355ecceb8b0f1e94e50567802150fed94c79\" not found"}
{"level":"error","ts":"2026-11-04T00:25:40.200Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-5a865b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-5a865b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:40.295Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-d3032c","namespace":"openshift-ingress","uid":"478850ab-690f-425e-8e92-762c89199df5","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-d3032c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:40.422Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-676aa1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-676aa1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:40.706Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-d3032c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-d3032c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:40.719Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:40.837Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-5a865b","namespace":"openshift-ingress","uid":"a113e555-ff39-4860-90c1-20684400f3fa","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-5a865b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:41.001Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-af2b39-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-a-af2b39-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T00:25:41.453Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:41.453Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:25:41.832Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-b-5a865b","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-b-5a865b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:42.197Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-af2b39","error":"gateways.gateway.networking.k8s.io \"e2e-api-a-af2b39\" not found"}
{"level":"error","ts":"2026-11-04T00:25:42.322Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-5a865b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-5a865b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:25:42.446Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-edf87d31","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:25:43Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"21d81c34-16d5-44df-8255-18d16b05d2e1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:25:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:25:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:25:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:25:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:25:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:25:43Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"f6be7e48-bff0-4bac-9712-779b4f1efe1b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:25:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:25:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:25:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:25:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:25:44Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:25:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:25:49.505Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthConfig","AuthPolicy","TokenRateLimitPolicy","Limitador","EnvoyFilter","Kuadrant","Gateway","ConfigMap"],"eventTypes":{"create":12,"delete":11,"update":12}}
{"level":"info","ts":"2026-11-04T00:25:49.807Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:49.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:52.255Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:52.453Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:25:52.547Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:25:52.547Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:52.547Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:25:55.942Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:25:55.942Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:55.952Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:25:55.954Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:25:55.964Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:55.964Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:25:56.110Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:25:58.533Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-18f9ee-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-18f9ee-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:25:59.981Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:25:59.981Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:26:11.494Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","AuthConfig","HTTPRoute","Gateway","EnvoyFilter","TokenRateLimitPolicy","AuthPolicy","ConfigMap"],"eventTypes":{"create":21,"update":24}}
{"level":"info","ts":"2026-11-04T00:26:11.839Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:14.115Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:26:14.235Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:26:14.235Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:26:17.478Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:26:17.514Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:26:17.516Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:17.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:26:17.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:26:17.526Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:17.526Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:26:19.929Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-ac96ab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-ac96ab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:26:20.443Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:20.443Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:26:21.013Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-cd7a00","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-cd7a00\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:26:21.958Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T00:26:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-cd7a00","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-cd7a00","reconcileID":"76dfeb86-102a-492a-8036-175fa79400c1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-cd7a00","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:26:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-cd7a00","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:26:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:26:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:26:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:26:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:26:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","reconcileID":"25d3b518-21bf-4ae8-886c-3edb9cb282d9","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:26:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:26:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:26:23Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:26:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:26:24Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:26:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","reconcileID":"25d3b518-21bf-4ae8-886c-3edb9cb282d9","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-18f9ee","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:26:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-cd7a00","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-cd7a00","reconcileID":"54bf2fae-6d9a-4e67-ba37-e5ba8d16ad94","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-cd7a00","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:26:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-cd7a00","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:26:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:26:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:26:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:26:25Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:26:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:26:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-18f9ee","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:26:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:26:25Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-a-18f9ee\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:26:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:26:27.561Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:26:27.624Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:27.624Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:26:27.737Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-1"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:04Z"}],"name":"38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414","namespace":"kuadrant-system","resourceVersion":"51431","uid":"50899ba7-9ec5-42a9-9aab-4fded3bd5da5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:27.804Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-3"},"creationTimestamp":"2026-11-04T00:25:27Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:25:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:25:28Z"}],"name":"f3d25405c0865a1d598be1b2b16f291e76078b760bfc7e8e5cc2be6be5e2e111","namespace":"kuadrant-system","resourceVersion":"53882","uid":"3b303a11-a6be-46d4-98cc-f110845b4293"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f3d25405c0865a1d598be1b2b16f291e76078b760bfc7e8e5cc2be6be5e2e111"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f3d25405c0865a1d598be1b2b16f291e76078b760bfc7e8e5cc2be6be5e2e111"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f3d25405c0865a1d598be1b2b16f291e76078b760bfc7e8e5cc2be6be5e2e111\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:27.878Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-6"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:02Z"}],"name":"500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464","namespace":"kuadrant-system","resourceVersion":"51310","uid":"e70c7941-e179-409b-89e9-5a04bed7db70"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:27.947Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-6"},"creationTimestamp":"2026-11-04T00:25:28Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:25:28Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:25:28Z"}],"name":"01fd5e4cfcfac54eec45ad9fde4111f8314b443f3b837472c59daba492772f6b","namespace":"kuadrant-system","resourceVersion":"53899","uid":"ec1f29d0-d539-44fe-9827-cbee220e8295"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01fd5e4cfcfac54eec45ad9fde4111f8314b443f3b837472c59daba492772f6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["01fd5e4cfcfac54eec45ad9fde4111f8314b443f3b837472c59daba492772f6b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"01fd5e4cfcfac54eec45ad9fde4111f8314b443f3b837472c59daba492772f6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:28.016Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-5"},"creationTimestamp":"2026-11-04T00:25:28Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:25:28Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:25:28Z"}],"name":"0af9c2d321369f409df44ead8a2ab44b4d370c9581f0d67b5438bca058c54199","namespace":"kuadrant-system","resourceVersion":"53885","uid":"6146374f-31c7-4cf2-b8e7-9b149f24e326"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0af9c2d321369f409df44ead8a2ab44b4d370c9581f0d67b5438bca058c54199"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0af9c2d321369f409df44ead8a2ab44b4d370c9581f0d67b5438bca058c54199"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0af9c2d321369f409df44ead8a2ab44b4d370c9581f0d67b5438bca058c54199\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:28.085Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-2"},"creationTimestamp":"2026-11-04T00:25:28Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:25:28Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:25:28Z"}],"name":"cfa664eb143e24e992179ee50e7d1689c76b73270f352e3fa59400b841203fa8","namespace":"kuadrant-system","resourceVersion":"53891","uid":"6c501c79-f476-41d7-a16d-8544765e1efd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cfa664eb143e24e992179ee50e7d1689c76b73270f352e3fa59400b841203fa8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cfa664eb143e24e992179ee50e7d1689c76b73270f352e3fa59400b841203fa8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cfa664eb143e24e992179ee50e7d1689c76b73270f352e3fa59400b841203fa8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:28.152Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-4"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:02Z"}],"name":"98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5","namespace":"kuadrant-system","resourceVersion":"51342","uid":"e25192e7-03d7-47c6-abd0-f45f279c2f61"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:28.223Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-1"},"creationTimestamp":"2026-11-04T00:25:28Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:25:28Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:25:30Z"}],"name":"9f093c9d7c079bb407fdaa7ef8358dd620e03f9387d3ec650a696196ca2fa1d7","namespace":"kuadrant-system","resourceVersion":"54017","uid":"ce73d1cc-d760-437e-9af6-43ba99e78381"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f093c9d7c079bb407fdaa7ef8358dd620e03f9387d3ec650a696196ca2fa1d7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:25:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:25:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9f093c9d7c079bb407fdaa7ef8358dd620e03f9387d3ec650a696196ca2fa1d7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9f093c9d7c079bb407fdaa7ef8358dd620e03f9387d3ec650a696196ca2fa1d7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:28.293Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-2"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:04Z"}],"name":"d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8","namespace":"kuadrant-system","resourceVersion":"51460","uid":"5f162e57-d35e-47d2-9c09-eb43243d4d73"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:28.360Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-3"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:03Z"}],"name":"aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c","namespace":"kuadrant-system","resourceVersion":"51377","uid":"6f14cfd9-c963-4470-b11b-98fb7137ce9f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:28.432Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-18f9ee#rule-5"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:03Z"}],"name":"908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590","namespace":"kuadrant-system","resourceVersion":"51389","uid":"387b34f0-b7b5-4df3-a342-29ad58fa173c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-18f9ee.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:28.500Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b#rule-4"},"creationTimestamp":"2026-11-04T00:25:27Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:25:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:25:28Z"}],"name":"2ab6078723b13af9190597ec0a7fe0e887e225d977740d9802500d57be8d51f3","namespace":"kuadrant-system","resourceVersion":"53873","uid":"b1522ebf-2692-4dbc-9174-5e03b2488fa9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ab6078723b13af9190597ec0a7fe0e887e225d977740d9802500d57be8d51f3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-5a865b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:25:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ab6078723b13af9190597ec0a7fe0e887e225d977740d9802500d57be8d51f3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ab6078723b13af9190597ec0a7fe0e887e225d977740d9802500d57be8d51f3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:29.089Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-ac96ab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-ac96ab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-676aa1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-676aa1","reconcileID":"d202c546-4027-4824-b336-70c7009a827d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-676aa1","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:26:29.243Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-676aa1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-676aa1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-676aa1","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-676aa1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-676aa1","reconcileID":"d202c546-4027-4824-b336-70c7009a827d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-676aa1","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:26:29.397Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-edf87d31-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-edf87d31-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-676aa1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-676aa1","reconcileID":"e3937240-bc5f-41dd-af04-3316860bf408","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-676aa1\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-676aa1","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-676aa1\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:26:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:26:29.626Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-5a865b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-5a865b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:29.693Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-18f9ee-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-18f9ee-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:29.761Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-d3032c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-d3032c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:30.274Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-cd7a00","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-cd7a00\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:30.528Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-18f9ee","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-18f9ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:30.851Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-676aa1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-676aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","reconcileID":"f81b137f-865d-4e42-9492-ae498d9e3419","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","reconcileID":"f81b137f-865d-4e42-9492-ae498d9e3419","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-ac96ab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-ac96ab","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-a-ac96ab\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:26:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:26:42.034Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","Limitador","Gateway","Kuadrant","HTTPRoute","EnvoyFilter","ConfigMap"],"eventTypes":{"create":3,"delete":6,"update":39}}
{"level":"info","ts":"2026-11-04T00:26:42.341Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:42.361Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:45.248Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:26:45.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:26:45.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:26:45.746Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:26:45.855Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:26:49.349Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:49.357Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:26:49.349Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:26:49.363Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:26:49.364Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:49.364Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:26:49.473Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:26:49.519Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-api-a-ac96ab","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-ac96ab\" not found"}
{"level":"error","ts":"2026-11-04T00:26:49.971Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-api-a-ac96ab","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:22:29Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"e2ba2671-05bf-4603-aef7-19dc64ac3034\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"}],"name":"kuadrant-e2e-api-a-ac96ab","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-ac96ab","uid":"e2ba2671-05bf-4603-aef7-19dc64ac3034"}],"resourceVersion":"48658","uid":"e5142ad3-2fd6-463e-b672-93fd32e4cdbe"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"8ff4f8cbf4b8b495e8f176b6ffe5091674538fd89b6a53a2ec421dec3a259795\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"18f533d697fcfed2393639869bba2f3d4559dca837ac4d516efccdc5efb1d525\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"6b4c2c88a52ba9c3bb2cb70002285632ffce6473cc02adbedc02a5e477395a6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"dc06e46c782c0d30e267e5c13626c9f3057b7c654a9df1c9bcf86268212a41f1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"315b3123c24a68d0166a2097e91ee946ee77c9f405d7b14bc98375577b7affd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"f6bd5f7b134e3d0f1ebe7dfd4b40f16be7cb1f79b6a4a3e0eaaa85d2a8dbe9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-ac96ab"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-ac96ab\" not found"}
{"level":"error","ts":"2026-11-04T00:26:51.969Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-d3032c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-d3032c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:26:52.123Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-ac96ab-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-a-ac96ab-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T00:26:52.892Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:52.892Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:26:52.948Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-ac96ab","error":"gateways.gateway.networking.k8s.io \"e2e-api-a-ac96ab\" not found"}
{"level":"error","ts":"2026-11-04T00:26:53.091Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-a-ac96ab","namespace":"odh-ai-gateway-infra","error":"httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-a-ac96ab\" not found"}
{"level":"info","ts":"2026-11-04T00:26:54.578Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","EnvoyFilter","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"delete":9,"update":2}}
{"level":"info","ts":"2026-11-04T00:26:54.849Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:54.862Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:26:58.123Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:26:58.444Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:26:58.655Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:26:58.657Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:26:58.657Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:02.047Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:27:02.051Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:02.059Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:27:02.115Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:27:02.129Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:02.129Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:27:02.172Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-cd7a00","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-a-cd7a00","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-cd7a00","uid":"01b12042-a5e5-4cbc-b794-eae5161b8f11"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-cd7a00"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-cd7a00\" already exists"}
{"level":"error","ts":"2026-11-04T00:27:02.173Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-cd7a00","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-a-cd7a00","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-cd7a00","uid":"01b12042-a5e5-4cbc-b794-eae5161b8f11"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-cd7a00"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-cd7a00\" already exists"}
{"level":"error","ts":"2026-11-04T00:27:02.174Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:27:02.174Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:27:02.208Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1757005ae56bc07993896ce2f1053fc9f71ebf87856bb12c26040c501f1bc448","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1757005ae56bc07993896ce2f1053fc9f71ebf87856bb12c26040c501f1bc448"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1757005ae56bc07993896ce2f1053fc9f71ebf87856bb12c26040c501f1bc448\" already exists"}
{"level":"error","ts":"2026-11-04T00:27:02.235Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-api-a-ac96ab","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-ac96ab\" not found"}
{"level":"error","ts":"2026-11-04T00:27:02.281Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"37886a80a219e823ec4c3cd95ffceea121b1032939de292d38b1ad30c639d5f9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["37886a80a219e823ec4c3cd95ffceea121b1032939de292d38b1ad30c639d5f9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"37886a80a219e823ec4c3cd95ffceea121b1032939de292d38b1ad30c639d5f9\" already exists"}
{"level":"error","ts":"2026-11-04T00:27:02.356Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-1"},"creationTimestamp":"2026-11-04T00:22:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:31Z"}],"name":"02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e","namespace":"kuadrant-system","resourceVersion":"52059","uid":"bbd0aa96-90b2-4e2d-a632-7828ac5f04d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:02.430Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-5"},"creationTimestamp":"2026-11-04T00:22:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:31Z"}],"name":"1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c","namespace":"kuadrant-system","resourceVersion":"52044","uid":"85583387-635c-4b2f-87cc-a4e626d63b10"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:29Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:29Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:02.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-3"},"creationTimestamp":"2026-11-04T00:22:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:32Z"}],"name":"34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f","namespace":"kuadrant-system","resourceVersion":"52081","uid":"6769bc65-d07c-414b-8d4a-3b3bc26d6ce2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:02.640Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1a76ccda5bb5646e002a4b78f19e92d5277066cbaca3346408f7010b3f30982a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1a76ccda5bb5646e002a4b78f19e92d5277066cbaca3346408f7010b3f30982a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1a76ccda5bb5646e002a4b78f19e92d5277066cbaca3346408f7010b3f30982a\" already exists"}
{"level":"error","ts":"2026-11-04T00:27:02.719Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8c49f93775f1d7cd23bbfa03a7d60b0f88d4e1cce090cb25b245034cabb79fd4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8c49f93775f1d7cd23bbfa03a7d60b0f88d4e1cce090cb25b245034cabb79fd4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8c49f93775f1d7cd23bbfa03a7d60b0f88d4e1cce090cb25b245034cabb79fd4\" already exists"}
{"level":"error","ts":"2026-11-04T00:27:02.787Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-6"},"creationTimestamp":"2026-11-04T00:22:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:31Z"}],"name":"f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa","namespace":"kuadrant-system","resourceVersion":"52050","uid":"0bba8f17-6214-4516-9a08-c6f1837f97f1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:02.870Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"366e2829a767fcb3c3fa97bef4440009b1fbdd3cecab881baa13f8c38e1b3c1b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["366e2829a767fcb3c3fa97bef4440009b1fbdd3cecab881baa13f8c38e1b3c1b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"366e2829a767fcb3c3fa97bef4440009b1fbdd3cecab881baa13f8c38e1b3c1b\" already exists"}
{"level":"error","ts":"2026-11-04T00:27:02.948Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4b85294fef6729c3a944d6b1b92560ae0283a9f3eb1934b50790d785ca9c9b19","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4b85294fef6729c3a944d6b1b92560ae0283a9f3eb1934b50790d785ca9c9b19"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-cd7a00.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4b85294fef6729c3a944d6b1b92560ae0283a9f3eb1934b50790d785ca9c9b19\" already exists"}
{"level":"error","ts":"2026-11-04T00:27:03.017Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-2"},"creationTimestamp":"2026-11-04T00:22:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:32Z"}],"name":"95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489","namespace":"kuadrant-system","resourceVersion":"52068","uid":"a57a155b-0736-45e4-b8da-31c74181e369"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:03.054Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-cd7a00","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-a-cd7a00","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-cd7a00","uid":"01b12042-a5e5-4cbc-b794-eae5161b8f11"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"366e2829a767fcb3c3fa97bef4440009b1fbdd3cecab881baa13f8c38e1b3c1b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"d626a1e34b6c9219c587a18e95923e62454969e23efc7dff25d22c3a1a07fc02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37886a80a219e823ec4c3cd95ffceea121b1032939de292d38b1ad30c639d5f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"d9e8957c2adf14b3f253d15fbab8c59466d6d5c906c6ae6420aee0d2cd1f9fed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8c49f93775f1d7cd23bbfa03a7d60b0f88d4e1cce090cb25b245034cabb79fd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"c92191558a4738031db32e37f4be58c6abf1d722a195ec27b3afbfee76ecdef9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b85294fef6729c3a944d6b1b92560ae0283a9f3eb1934b50790d785ca9c9b19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"d55cfe5148a56d7fdb0291eca436a3a9b7aa6772027f4d08ef453b1241bfbbee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1757005ae56bc07993896ce2f1053fc9f71ebf87856bb12c26040c501f1bc448\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"fbd663869b42eb049d8b6f553a3f638b7e0b19cec01b7f610d526dea303588d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76ccda5bb5646e002a4b78f19e92d5277066cbaca3346408f7010b3f30982a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"89988d116cdca93fb36b2518a3480f4801bd7c731a2ccbf672139c01deb9eb3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-cd7a00"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-cd7a00\" already exists"}
{"level":"error","ts":"2026-11-04T00:27:03.089Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-ac96ab#rule-4"},"creationTimestamp":"2026-11-04T00:22:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:24:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:24:32Z"}],"name":"b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291","namespace":"kuadrant-system","resourceVersion":"52065","uid":"923dde91-3b9c-46ab-aca1-474b60df00f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-ac96ab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:24:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:24:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:03.147Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464","error":"authconfigs.authorino.kuadrant.io \"500c98b2d87a52ceb16626832118d8120dd8f32552ffbdc76183ac84d9557464\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.201Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8","error":"authconfigs.authorino.kuadrant.io \"d74506c987e937c0b73d6c0de836b0abb0cb69817539205f8b59354dca4a70a8\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.225Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-api-a-ac96ab","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:22:29Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"e2ba2671-05bf-4603-aef7-19dc64ac3034\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:29Z"}],"name":"kuadrant-e2e-api-a-ac96ab","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-ac96ab","uid":"e2ba2671-05bf-4603-aef7-19dc64ac3034"}],"resourceVersion":"48658","uid":"e5142ad3-2fd6-463e-b672-93fd32e4cdbe"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f35c07f3838b4d4ef088b07cb69f371247db4a9c32478eaefe831cec96c418aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"8ff4f8cbf4b8b495e8f176b6ffe5091674538fd89b6a53a2ec421dec3a259795\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95c26b2422a5d23a18d07f9562da8c16f55a3f8a4b27e394128814799b213489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"18f533d697fcfed2393639869bba2f3d4559dca837ac4d516efccdc5efb1d525\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1339b4f802fe81b22f7ee88c762051757379e2960c621fb59110b684afbb0f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"6b4c2c88a52ba9c3bb2cb70002285632ffce6473cc02adbedc02a5e477395a6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34001285a7ebd6af9df784715e79d305413fad8648bf1d2bf601b1ed2e701d6f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"dc06e46c782c0d30e267e5c13626c9f3057b7c654a9df1c9bcf86268212a41f1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7f0dd94a6c3df11c01987d60d9c2d69aa3dc530dc0848272ee0d3e158262291\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"315b3123c24a68d0166a2097e91ee946ee77c9f405d7b14bc98375577b7affd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"02bb87102a3d441371e9ef4caa30ff28576503e431190601c40625bf7654fd9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-ac96ab-maas-auth\"]}],\"name\":\"f6bd5f7b134e3d0f1ebe7dfd4b40f16be7cb1f79b6a4a3e0eaaa85d2a8dbe9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-ac96ab"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-ac96ab\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.256Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c","error":"authconfigs.authorino.kuadrant.io \"aaa66bb5ef2b46fb10e18dd935cd4b81384a909e40b28135045eb9205365cb2c\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.310Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414","error":"authconfigs.authorino.kuadrant.io \"38873eb865dae6d4f795d23dd27f3d0f3ae944059d43cf8d62b3e50ab116f414\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.364Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc","error":"authconfigs.authorino.kuadrant.io \"b53d1211917ea28bf23cfa178241ef9ede0a7a79b15870204444baf40deabfdc\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.423Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590","error":"authconfigs.authorino.kuadrant.io \"908238dd6775421394e069146429b3310def19efdab55e54878b0069553bd590\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.485Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44","error":"authconfigs.authorino.kuadrant.io \"e0fd16390bff20aa4d9223a111180970de9c3515b121e2828290e99571a1ee44\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.539Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118","error":"authconfigs.authorino.kuadrant.io \"b21b288a5e748dd2726c0181ff2446672d622f0ed308cec086a058dd70aa0118\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.594Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5","error":"authconfigs.authorino.kuadrant.io \"98e989844de7ec04b026f6a7a452ef5a4315a42978c21a5f1e6e2ed41456eaa5\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.648Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7","error":"authconfigs.authorino.kuadrant.io \"dca1d0c5b533821402b73b21d4527f7da0f77719aeb3eb9d69307541c1d8cfc7\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.703Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6","error":"authconfigs.authorino.kuadrant.io \"95ce385fb98075ef27b2b1ef76d655f4b66b6f914b7c260d36b9722ca1c237c6\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.757Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2","error":"authconfigs.authorino.kuadrant.io \"ec97ad7dbad82256c29b2d03f3927d467bc60dbe390839e665d1cd4ba27c22d2\" not found"}
{"level":"error","ts":"2026-11-04T00:27:03.818Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:03.826Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-5a865b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-5a865b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:03.882Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:03.946Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.006Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-5a865b","namespace":"openshift-ingress","uid":"a113e555-ff39-4860-90c1-20684400f3fa","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-5a865b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.065Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.091Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-cd7a00-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-cd7a00-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.128Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-d3032c","namespace":"openshift-ingress","uid":"478850ab-690f-425e-8e92-762c89199df5","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-d3032c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.190Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.248Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.307Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-cd7a00","namespace":"openshift-ingress","uid":"acfb3dde-a5eb-45d9-9f6a-55433881d9e0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-cd7a00\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.365Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.394Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-d3032c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-d3032c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.554Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.613Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.690Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-ac96ab-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-a-ac96ab-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:27:04.738Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-edf87d31","namespace":"openshift-ingress","uid":"f01a2b15-bcb7-4bde-b656-1d1204fe53ce","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:04.985Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:05.044Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:05.154Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:27:05.154Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:05.154Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:27:05.313Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-ac96ab","error":"gateways.gateway.networking.k8s.io \"e2e-api-a-ac96ab\" not found"}
{"level":"error","ts":"2026-11-04T00:27:05.383Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-a-ac96ab","namespace":"odh-ai-gateway-infra","error":"httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-a-ac96ab\" not found"}
{"level":"error","ts":"2026-11-04T00:27:05.455Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-a-cd7a00","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-a-cd7a00\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:05.996Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-cd7a00","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-cd7a00\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:27:13.183Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","AuthPolicy","Gateway","EnvoyFilter","Limitador","ConfigMap","HTTPRoute"],"eventTypes":{"create":10,"delete":18,"update":29}}
{"level":"info","ts":"2026-11-04T00:27:13.547Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:15.035Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:27:15.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:27:15.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:18.653Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:27:18.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:18.662Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:18.662Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:18.664Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:27:18.664Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:18.664Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","reconcileID":"b5c2770a-5f27-4616-a2fa-9d89dd4e9b33","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","reconcileID":"b5c2770a-5f27-4616-a2fa-9d89dd4e9b33","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-d3032c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:27:21.559Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:21.559Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-d3032c","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-d3032c\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:27:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:27:22.083Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-d3032c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-d3032c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:27:32.789Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","TokenRateLimitPolicy","AuthPolicy","Kuadrant","ConfigMap","HTTPRoute"],"eventTypes":{"create":1,"delete":8,"update":33}}
{"level":"info","ts":"2026-11-04T00:27:32.990Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:33.005Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:35.631Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:35.661Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:27:35.818Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:27:35.819Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:27:35.819Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","reconcileID":"9786e4a5-44e0-4765-9d29-6e09b5bd4f7d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:27:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:27:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:27:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:27:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:27:37Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:27:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:27:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","reconcileID":"3612c48a-b463-4d50-a326-78d9a81fb943","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:27:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:27:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:27:39.221Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:27:39.221Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:39.228Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:27:39.239Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:39.239Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:39.246Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","reconcileID":"b15659c4-363b-465b-a40f-c1948e34c350","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:27:39.332Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:27:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:27:41.752Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:41.753Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:27:42.169Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-edf87d31","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","reconcileID":"9db35ed2-2d46-4d12-af75-80cedd5c6276","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:27:42.683Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-f080e1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-f080e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","reconcileID":"9db35ed2-2d46-4d12-af75-80cedd5c6276","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-5a865b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-5a865b","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-5a865b\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:27:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:27:43.141Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":1,"delete":5}}
{"level":"info","ts":"2026-11-04T00:27:48.037Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:27:48.045Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:48.045Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:27:48.055Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:48.055Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:27:48.061Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:27:48.121Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:27:48.121Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:27:48.175Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/92108f06f42c5147fe403a34e2e462e1c080fef48daece3d661608c5516649be","error":"authconfigs.authorino.kuadrant.io \"92108f06f42c5147fe403a34e2e462e1c080fef48daece3d661608c5516649be\" not found"}
{"level":"error","ts":"2026-11-04T00:27:48.230Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0a85549e2e8eaa24cf84f340e0ceeb8abead9f3c09cb6d25f65f51ff1b7aa2e6","error":"authconfigs.authorino.kuadrant.io \"0a85549e2e8eaa24cf84f340e0ceeb8abead9f3c09cb6d25f65f51ff1b7aa2e6\" not found"}
{"level":"error","ts":"2026-11-04T00:27:48.285Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7f3dfd72d821cd5ac42b13ed6aa6ed8dc31445ecf3d5fedc1315f0c837dfd736","error":"authconfigs.authorino.kuadrant.io \"7f3dfd72d821cd5ac42b13ed6aa6ed8dc31445ecf3d5fedc1315f0c837dfd736\" not found"}
{"level":"error","ts":"2026-11-04T00:27:48.339Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f73a77de8285e743fe25877ce101aa4f57768e256989a0cf2dcefc8096ff2715","error":"authconfigs.authorino.kuadrant.io \"f73a77de8285e743fe25877ce101aa4f57768e256989a0cf2dcefc8096ff2715\" not found"}
{"level":"error","ts":"2026-11-04T00:27:48.413Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0311060b5b473e7633fdd4a161794f37edb03ede4f886372d03bee99db421048","error":"authconfigs.authorino.kuadrant.io \"0311060b5b473e7633fdd4a161794f37edb03ede4f886372d03bee99db421048\" not found"}
{"level":"error","ts":"2026-11-04T00:27:48.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2787acfaeea1b4e70f25ad9a7f2aee442ac9d197db709b86b7d8756b4ccaede9","error":"authconfigs.authorino.kuadrant.io \"2787acfaeea1b4e70f25ad9a7f2aee442ac9d197db709b86b7d8756b4ccaede9\" not found"}
{"level":"error","ts":"2026-11-04T00:27:48.665Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-api-b-5a865b","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:25:29Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b84ba5ae-1f21-4e7f-b7a6-69c96a982993\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:25:29Z"}],"name":"kuadrant-e2e-api-b-5a865b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-5a865b","uid":"b84ba5ae-1f21-4e7f-b7a6-69c96a982993"}],"resourceVersion":"53936","uid":"fa0ee82e-dd50-4941-9d92-da4d6679aede"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01fd5e4cfcfac54eec45ad9fde4111f8314b443f3b837472c59daba492772f6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"9ea7a714de9c05c8446f623862d225fcbb6b5389d1556380d17f44054a79d01b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cfa664eb143e24e992179ee50e7d1689c76b73270f352e3fa59400b841203fa8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"19994d22408fa52301332c77ec4522366459e08ca2fdeadf635f08500b1b2254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0af9c2d321369f409df44ead8a2ab44b4d370c9581f0d67b5438bca058c54199\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"85dda71cc686b196ca164123a20015d22c5d46ec1c2bbee53420c935127cd660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3d25405c0865a1d598be1b2b16f291e76078b760bfc7e8e5cc2be6be5e2e111\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"1d71d56974f179a07000dc26299ced9a1d29d277c1b6b7068f3a11128017d1f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab6078723b13af9190597ec0a7fe0e887e225d977740d9802500d57be8d51f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"5d4a54c29302fb73e2cc1850bd074884590c0fd474acaca13c1beda0130b72a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f093c9d7c079bb407fdaa7ef8358dd620e03f9387d3ec650a696196ca2fa1d7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-5a865b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cbc4402b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-5a865b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-5a865b\"]}],\"name\":\"18c409e0c7a2d4bf507fd1cc6cb2c657326fdb3c23e659cea7fabea7d024f0ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-5a865b"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-b-5a865b\" not found"}
{"level":"error","ts":"2026-11-04T00:27:49.275Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:49.339Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:49.411Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-edf87d31","namespace":"openshift-ingress","uid":"f01a2b15-bcb7-4bde-b656-1d1204fe53ce","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:49.535Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:49.594Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:49.653Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:49.710Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-5a865b","namespace":"openshift-ingress","uid":"a113e555-ff39-4860-90c1-20684400f3fa","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-5a865b\" not found"}
{"level":"error","ts":"2026-11-04T00:27:49.768Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:49.830Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-5a865b-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-b-5a865b-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:27:49.887Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-cd7a00","namespace":"openshift-ingress","uid":"acfb3dde-a5eb-45d9-9f6a-55433881d9e0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-cd7a00\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:49.945Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:50.071Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:50.131Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:50.312Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:50.370Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:50.429Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:27:50.490Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:50.490Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:27:50.550Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-edf87d31","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-edf87d31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:27:51.099Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-5a865b","error":"gateways.gateway.networking.k8s.io \"e2e-api-b-5a865b\" not found"}
{"level":"error","ts":"2026-11-04T00:27:51.288Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-f080e1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-f080e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:27:58.439Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","Kuadrant","Limitador","ConfigMap","HTTPRoute","AuthPolicy","EnvoyFilter","AuthConfig"],"eventTypes":{"create":4,"delete":14,"update":19}}
{"level":"info","ts":"2026-11-04T00:27:58.799Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:27:58.819Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:01.114Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:28:01.244Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:01.324Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:28:01.426Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:28:01.426Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:04.044Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:28:04.053Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:04.053Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:04.055Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:04.058Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:28:04.061Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:28:04.167Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:28:04.167Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:07.244Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:07.244Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"10f3d923-1796-4c32-92c8-0ed7c3cbff9c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"10f3d923-1796-4c32-92c8-0ed7c3cbff9c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-edf87d31","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","reconcileID":"1f483c6a-17f5-4e1f-be7b-61453f8c541c","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-mt-edf87d31\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-edf87d31","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-mt-edf87d31\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:28:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","reconcileID":"ee576fef-76c3-4c70-99fa-19397d078d2a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","reconcileID":"3e9ac865-70dc-4e9f-94ed-06ea621c7190","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:28:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:28:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:28:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:28:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:16Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","reconcileID":"9d851b3e-c45d-4f59-bc3e-33204fa4a139","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:28:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:28:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:28:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:28:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:28:17Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:28:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:19.054Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthConfig","Kuadrant","TokenRateLimitPolicy","Limitador","Gateway","AuthPolicy","ConfigMap","HTTPRoute"],"eventTypes":{"create":9,"delete":20,"update":9}}
{"level":"info","ts":"2026-11-04T00:28:19.260Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:19.280Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:22.027Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:28:22.162Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:22.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:28:22.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:22.426Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:28:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","reconcileID":"df0d247a-a169-44dd-a731-247eac10d0e8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:28:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:28:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:28:25.531Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:28:25.543Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:25.552Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:28:25.555Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:25.555Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:25.559Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:28:25.683Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:28:25.736Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-mt-edf87d31","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:28:25.736Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-mt-edf87d31","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-mt-edf87d31\" not found"}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","reconcileID":"00e5f654-7ec7-4212-96ff-d650b14ed048","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","reconcileID":"305d8823-bd8d-43c7-87a2-de0cef9c9dca","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:28:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:28:26.747Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-mt-edf87d31","envoyfilter":"openshift-ingress/kuadrant-e2e-mt-edf87d31","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:28:27.002Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:28:27.127Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:28:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:28:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:28:27Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:28:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:28.082Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:28.082Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:28:28.805Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-edf87d31","error":"gateways.gateway.networking.k8s.io \"e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:28:29.002Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-f989de","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-f989de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:28:29.344Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Kuadrant","AuthPolicy","HTTPRoute","Gateway"],"eventTypes":{"create":3,"delete":1,"update":2}}
{"level":"info","ts":"2026-11-04T00:28:29.729Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:29.771Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:32.714Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:32.853Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:28:33.061Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:28:33.062Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:33.063Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:28:36.057Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:28:36.061Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:36.126Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:28:36.128Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:28:36.131Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:36.131Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:28:36.181Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-652268","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-b-652268","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-652268","uid":"00c77e93-ddcc-4c34-9e43-fcafcb0846b4"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-652268"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-b-652268\" already exists"}
{"level":"error","ts":"2026-11-04T00:28:36.181Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-652268","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-b-652268","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-652268","uid":"00c77e93-ddcc-4c34-9e43-fcafcb0846b4"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-652268"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-b-652268\" already exists"}
{"level":"error","ts":"2026-11-04T00:28:36.213Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"447c45cfe535cebdba1569b188ac8d01ea48bf4440de85e5471892ef29868328","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["447c45cfe535cebdba1569b188ac8d01ea48bf4440de85e5471892ef29868328"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"447c45cfe535cebdba1569b188ac8d01ea48bf4440de85e5471892ef29868328\" already exists"}
{"level":"error","ts":"2026-11-04T00:28:36.226Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:28:36.226Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:28:36.236Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-mt-edf87d31","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:28:36.236Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-mt-edf87d31","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:28:36.295Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"80179e245c4697e5781a1b5750aa9314ad4e1b0d566f6532ba9600a0568e112a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80179e245c4697e5781a1b5750aa9314ad4e1b0d566f6532ba9600a0568e112a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"80179e245c4697e5781a1b5750aa9314ad4e1b0d566f6532ba9600a0568e112a\" already exists"}
{"level":"error","ts":"2026-11-04T00:28:36.389Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8b1e296a9fc2fbaff07b160ba509e8b5f544a0011cbbc92bd8d228490b881d38","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8b1e296a9fc2fbaff07b160ba509e8b5f544a0011cbbc92bd8d228490b881d38"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8b1e296a9fc2fbaff07b160ba509e8b5f544a0011cbbc92bd8d228490b881d38\" already exists"}
{"level":"error","ts":"2026-11-04T00:28:36.462Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e508970e46b5c8173360bad4867080e506db70c8e30a962be367cc217649f19c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e508970e46b5c8173360bad4867080e506db70c8e30a962be367cc217649f19c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e508970e46b5c8173360bad4867080e506db70c8e30a962be367cc217649f19c\" already exists"}
{"level":"error","ts":"2026-11-04T00:28:36.534Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f00ca4c3c623c6b54203e5b2782293aaa98cc45e8b70c9c71380a15c889fe0ef","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f00ca4c3c623c6b54203e5b2782293aaa98cc45e8b70c9c71380a15c889fe0ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f00ca4c3c623c6b54203e5b2782293aaa98cc45e8b70c9c71380a15c889fe0ef\" already exists"}
{"level":"error","ts":"2026-11-04T00:28:36.611Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6ae3f9b6d3ee9bbb21ed95202b119dea8564265b239e9f4a48b1208e3c45e26d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ae3f9b6d3ee9bbb21ed95202b119dea8564265b239e9f4a48b1208e3c45e26d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-652268.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6ae3f9b6d3ee9bbb21ed95202b119dea8564265b239e9f4a48b1208e3c45e26d\" already exists"}
{"level":"error","ts":"2026-11-04T00:28:36.680Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f","error":"authconfigs.authorino.kuadrant.io \"eea10afe2f13672068a094409a1308cb8d76f124e245a871527f6be595c35d2f\" not found"}
{"level":"error","ts":"2026-11-04T00:28:36.737Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010","error":"authconfigs.authorino.kuadrant.io \"eebf6a6bb042ae934b87591d0c9724f95bfcd9b7307ab11fe3808f520f317010\" not found"}
{"level":"error","ts":"2026-11-04T00:28:36.827Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718","error":"authconfigs.authorino.kuadrant.io \"6ebf1bec8645be3079bfa23cb6a5ad1dab019600d6ac8eb495bed1ba59bf5718\" not found"}
{"level":"error","ts":"2026-11-04T00:28:36.882Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22","error":"authconfigs.authorino.kuadrant.io \"c3d08f465a1a679b5206914ee1b06febdcbf4771374b3ddfe2ab43d958fcbf22\" not found"}
{"level":"error","ts":"2026-11-04T00:28:36.937Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358","error":"authconfigs.authorino.kuadrant.io \"bbbf1b4234d0e695b783164466154870635c2e5b20dfeac69c23f8c60b409358\" not found"}
{"level":"error","ts":"2026-11-04T00:28:36.937Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-mt-edf87d31","envoyfilter":"openshift-ingress/kuadrant-e2e-mt-edf87d31","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:28:36.994Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba","error":"authconfigs.authorino.kuadrant.io \"913c040b1fffc3b7d05c4c7c457b60d30aa178cbb3cb0ffb87fd75e32077b6ba\" not found"}
{"level":"error","ts":"2026-11-04T00:28:37.139Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-652268","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-b-652268","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-652268","uid":"00c77e93-ddcc-4c34-9e43-fcafcb0846b4"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e508970e46b5c8173360bad4867080e506db70c8e30a962be367cc217649f19c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-652268-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]}],\"name\":\"e81de252a4e1f9a95545408d262e39b2f2dbeb2c9360c6045fe449d27cb0cef5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ae3f9b6d3ee9bbb21ed95202b119dea8564265b239e9f4a48b1208e3c45e26d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-652268-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]}],\"name\":\"ad90b136a254bd1e2eccfd6fc6a6bcd22b257d076d92ba823e26f06505c6d655\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b1e296a9fc2fbaff07b160ba509e8b5f544a0011cbbc92bd8d228490b881d38\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-652268-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]}],\"name\":\"0f724b60d61bf95f05d5c942dd84ca4fac32e2b3b4cff2d1a8229f664e998e9a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"447c45cfe535cebdba1569b188ac8d01ea48bf4440de85e5471892ef29868328\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-652268-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]}],\"name\":\"4efdbbffae2f1be377e43851ef76d9b57728070a2154b78ed3bd84eab3827f5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f00ca4c3c623c6b54203e5b2782293aaa98cc45e8b70c9c71380a15c889fe0ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-652268-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]}],\"name\":\"a331b0788b6a8415db553ffca337322c2c13e2b39f79856ccc3bf6ba16ffe143\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80179e245c4697e5781a1b5750aa9314ad4e1b0d566f6532ba9600a0568e112a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-652268-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a193da7f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-652268\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-652268\"]}],\"name\":\"6a7985e8420dd57fd05c1918c8bab6649f2e80811b822e487adf85cf9680db77\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-652268"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-652268\" already exists"}
{"level":"error","ts":"2026-11-04T00:28:37.548Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:28:37.562Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:28:37.621Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-f080e1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-f080e1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:28:37.693Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-652268-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-652268-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:28:38.119Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-652268","namespace":"openshift-ingress","uid":"c2fe6efa-57b8-43dd-ade8-c215d2eade6a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-652268\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:28:38.550Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-f080e1","namespace":"openshift-ingress","uid":"10a4651c-45e3-4b44-82ea-e80bf72f0444","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-f080e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:28:38.611Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:38.611Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:28:38.806Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-b-652268","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-b-652268\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:28:39.276Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-f989de","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-f989de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:28:39.397Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-edf87d31","error":"gateways.gateway.networking.k8s.io \"e2e-mt-edf87d31\" not found"}
{"level":"error","ts":"2026-11-04T00:28:39.591Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-652268","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-652268\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:28:46.626Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","ConfigMap","Gateway","Kuadrant","EnvoyFilter","AuthConfig","HTTPRoute","Limitador"],"eventTypes":{"create":12,"delete":10,"update":12}}
{"level":"info","ts":"2026-11-04T00:28:46.981Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:47.001Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:48Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e99a10","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e99a10","reconcileID":"27db9228-1bdf-4c39-9cac-6b5f3ec539f2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-e99a10","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:28:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e99a10","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:28:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:28:49.423Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:49.433Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:28:49.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:28:49.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:49.714Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:28:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:28:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:28:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e99a10","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e99a10","reconcileID":"e2285835-9fa3-4a00-89a5-e083bec13fcf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-e99a10","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:28:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e99a10","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:28:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:28:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:28:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:28:51Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:28:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:28:52.299Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:28:52.315Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:52.315Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:28:52.316Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:28:52.322Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:28:52.325Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:28:52.476Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:02.585Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:02.585Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:29:02.646Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-e99a10","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-e99a10\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:29:10.741Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","ConfigMap","Gateway","EnvoyFilter","Limitador","Kuadrant"],"eventTypes":{"create":12,"update":115}}
{"level":"info","ts":"2026-11-04T00:29:11.042Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:11.063Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:13.526Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:29:13.539Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:13.554Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:29:13.755Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:29:13.755Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:17.945Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:29:17.952Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:17.958Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:29:17.960Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:17.960Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:17.962Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:29:18.063Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:29:18.063Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:20.889Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:20.889Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:29.443Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthConfig","TokenRateLimitPolicy","EnvoyFilter","Gateway","Limitador","AuthPolicy","HTTPRoute"],"eventTypes":{"create":9,"update":9}}
{"level":"info","ts":"2026-11-04T00:29:29.789Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:32.445Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:29:32.614Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:29:32.614Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:36.249Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:29:36.256Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:36.256Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:36.266Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:36.267Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:29:36.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:29:36.431Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:38.909Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:38.909Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:49.937Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-cd7a00","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-cd7a00","reconcileID":"eeabcfb8-3cff-49d9-b7e3-73939520bf74","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-cd7a00","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-cd7a00","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-cd7a00","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-cd7a00","reconcileID":"eeabcfb8-3cff-49d9-b7e3-73939520bf74","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-cd7a00","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:29:50.496Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"error","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-cd7a00","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-cd7a00","reconcileID":"83eb8838-e252-4a8a-81fa-cef03abb1186","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-cd7a00\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-cd7a00","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-cd7a00\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:29:51.928Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:29:52.066Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:29:52.066Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:55.746Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:29:55.746Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:55.753Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:29:55.753Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:29:55.814Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:29:55.815Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:55.815Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:29:58.260Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-cd7a00","namespace":"openshift-ingress","uid":"acfb3dde-a5eb-45d9-9f6a-55433881d9e0","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-cd7a00\" not found"}
{"level":"info","ts":"2026-11-04T00:29:58.824Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:29:58.824Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:29:59.571Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-cd7a00","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-a-cd7a00\" not found"}
{"level":"info","ts":"2026-11-04T00:30:00.188Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-04T00:30:06.241Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:30:06.241Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:06.248Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:30:06.248Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:06.260Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:06.260Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:06.266Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:30:06.795Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-cd7a00","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:26:50Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"01b12042-a5e5-4cbc-b794-eae5161b8f11\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:26:50Z"}],"name":"kuadrant-e2e-ipp-a-cd7a00","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-cd7a00","uid":"01b12042-a5e5-4cbc-b794-eae5161b8f11"}],"resourceVersion":"56664","uid":"4647cde4-dee2-4c96-a3f0-a80789e653c0"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"366e2829a767fcb3c3fa97bef4440009b1fbdd3cecab881baa13f8c38e1b3c1b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"d626a1e34b6c9219c587a18e95923e62454969e23efc7dff25d22c3a1a07fc02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37886a80a219e823ec4c3cd95ffceea121b1032939de292d38b1ad30c639d5f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"d9e8957c2adf14b3f253d15fbab8c59466d6d5c906c6ae6420aee0d2cd1f9fed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8c49f93775f1d7cd23bbfa03a7d60b0f88d4e1cce090cb25b245034cabb79fd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"c92191558a4738031db32e37f4be58c6abf1d722a195ec27b3afbfee76ecdef9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b85294fef6729c3a944d6b1b92560ae0283a9f3eb1934b50790d785ca9c9b19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"d55cfe5148a56d7fdb0291eca436a3a9b7aa6772027f4d08ef453b1241bfbbee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1757005ae56bc07993896ce2f1053fc9f71ebf87856bb12c26040c501f1bc448\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"fbd663869b42eb049d8b6f553a3f638b7e0b19cec01b7f610d526dea303588d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76ccda5bb5646e002a4b78f19e92d5277066cbaca3346408f7010b3f30982a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-cd7a00-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__69c1df8a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-cd7a00\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-cd7a00\"]}],\"name\":\"89988d116cdca93fb36b2518a3480f4801bd7c731a2ccbf672139c01deb9eb3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-cd7a00"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-cd7a00\" not found"}
{"level":"error","ts":"2026-11-04T00:30:07.642Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-e99a10","namespace":"openshift-ingress","uid":"dac188b1-7d08-4a80-a967-6f39d7e96875","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-e99a10\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:07.702Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:07.761Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:07.820Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:07.877Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-cd7a00","namespace":"openshift-ingress","uid":"acfb3dde-a5eb-45d9-9f6a-55433881d9e0","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-cd7a00\" not found"}
{"level":"error","ts":"2026-11-04T00:30:07.935Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:07.984Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-cd7a00-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-a-cd7a00-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:30:07.994Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.115Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.174Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.293Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.352Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.411Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.533Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-f080e1","namespace":"openshift-ingress","uid":"10a4651c-45e3-4b44-82ea-e80bf72f0444","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-f080e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.592Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.712Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-652268","namespace":"openshift-ingress","uid":"c2fe6efa-57b8-43dd-ade8-c215d2eade6a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-652268\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.831Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:08.891Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-f989de","namespace":"openshift-ingress","uid":"1fd767ef-d69a-4b9a-93cb-507340599e70","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-f989de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:30:08.891Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:08.892Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:30:09.336Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-cd7a00","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-a-cd7a00\" not found"}
{"level":"info","ts":"2026-11-04T00:30:16.817Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","ConfigMap","Limitador","Kuadrant","EnvoyFilter","HTTPRoute","AuthPolicy"],"eventTypes":{"create":1,"delete":7,"update":19}}
{"level":"info","ts":"2026-11-04T00:30:17.310Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:17.325Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:19.859Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:30:19.950Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:30:20.053Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:20.146Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:30:20.146Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:23.146Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:30:23.160Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:23.160Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:23.177Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:30:23.177Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:23.262Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:30:23.381Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:30:24.978Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:30:25.724Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:25.724Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:36.821Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap","AuthConfig"],"eventTypes":{"delete":6,"update":18}}
{"level":"info","ts":"2026-11-04T00:30:37.063Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:38.540Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:30:38.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:30:38.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:41.662Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:41.662Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:41.714Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:30:41.743Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:41.765Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:30:41.765Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:45.095Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:45.096Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:46.527Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-04T00:30:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","reconcileID":"add28423-4a76-46e7-ab8e-bc2a33fffcec","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:30:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:30:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:30:51.237Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:30:51.247Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:51.247Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:51.254Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:30:51.313Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:51.319Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:30:51.319Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:30:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:30:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:30:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:30:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","reconcileID":"9e78cc4b-9082-4293-bc2f-d34852c0e70d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:30:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:30:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:30:52.469Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:04:16Z","generation":13,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"af1b8c6b-0ceb-4134-aa61-de1746b60d18\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:28:53Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"af1b8c6b-0ceb-4134-aa61-de1746b60d18"}],"resourceVersion":"60678","uid":"edcce1ea-eb55-46d5-a2c7-9f7dda82aae1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:30:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:30:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:30:52Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:30:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:30:52Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","reconcileID":"14779bfe-75f5-47f7-8f96-8818742b2df5","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:30:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:30:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:30:52.755Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:52.813Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-652268","namespace":"openshift-ingress","uid":"c2fe6efa-57b8-43dd-ade8-c215d2eade6a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-652268\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:52.871Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:52.990Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:30:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:30:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:30:53Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:30:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:30:53.170Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.229Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-f080e1","namespace":"openshift-ingress","uid":"10a4651c-45e3-4b44-82ea-e80bf72f0444","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-f080e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.288Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.407Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.466Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.525Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.585Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.645Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.765Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-f989de","namespace":"openshift-ingress","uid":"1fd767ef-d69a-4b9a-93cb-507340599e70","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-f989de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.824Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:53.883Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-e99a10","namespace":"openshift-ingress","uid":"dac188b1-7d08-4a80-a967-6f39d7e96875","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-e99a10\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:30:54.003Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:30:54.003Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:30:54.003Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:30:54.925Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-055cad","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-055cad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:31:00Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","reconcileID":"e4e19134-7f5a-41ab-981a-e96ee99798fa","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:31:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:31:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:31:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:31:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:31:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:31:00Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","reconcileID":"ccf4ef71-25b8-4da4-864b-1bf5e30de625","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","reconcileID":"05a3d8f9-af2c-4c0f-a3e8-7f581768ff17","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","reconcileID":"05a3d8f9-af2c-4c0f-a3e8-7f581768ff17","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-652268","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","reconcileID":"150cc4cb-227a-435d-9e56-ba647ca340d9","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:31:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:31:02Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:31:02Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:31:02Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:31:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:31:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-652268","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:31:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:31:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-652268\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:31:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:31:05.462Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","TokenRateLimitPolicy","ConfigMap","Kuadrant","EnvoyFilter","Limitador","AuthPolicy","Gateway"],"eventTypes":{"create":3,"update":21}}
{"level":"info","ts":"2026-11-04T00:31:05.660Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:05.680Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:08.149Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:31:08.516Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:31:08.561Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:08.644Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:31:08.645Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:11.479Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:31:11.486Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:11.489Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:11.489Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:11.493Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:31:11.494Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:31:11.606Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:31:11.863Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-b-652268","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-b-652268\" not found"}
{"level":"error","ts":"2026-11-04T00:31:11.870Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-b-652268","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-b-652268\" not found"}
{"level":"error","ts":"2026-11-04T00:31:12.427Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-652268","envoyfilter":"openshift-ingress/kuadrant-e2e-ipp-b-652268","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-652268\" not found"}
{"level":"error","ts":"2026-11-04T00:31:13.176Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-652268-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-b-652268-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T00:31:14.558Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:14.558Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:31:15.433Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-652268","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-b-652268\" not found"}
{"level":"info","ts":"2026-11-04T00:31:16.143Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthPolicy","TokenRateLimitPolicy","Gateway","Kuadrant"],"eventTypes":{"create":3,"delete":2,"update":3}}
{"level":"info","ts":"2026-11-04T00:31:16.474Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:16.492Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:20.237Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:20.514Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:31:20.624Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:31:20.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:31:20.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:23.953Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:31:23.953Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:23.963Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:31:23.969Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:31:23.980Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:23.980Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:31:24.077Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:31:24.077Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:31:24.077Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-ccd0bb","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-ccd0bb","uid":"b95911db-c81c-4a50-b054-a5bdb51c00e5"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-ccd0bb"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-b-ccd0bb\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.078Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-ccd0bb","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-ccd0bb","uid":"b95911db-c81c-4a50-b054-a5bdb51c00e5"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-ccd0bb"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-b-ccd0bb\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.084Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dd56c888b45e21658e0e61097f3c66d2af8824cce8cc1b5cb9e264b1852021f2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd56c888b45e21658e0e61097f3c66d2af8824cce8cc1b5cb9e264b1852021f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dd56c888b45e21658e0e61097f3c66d2af8824cce8cc1b5cb9e264b1852021f2\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.141Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-055cad","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-b-055cad","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-055cad","uid":"32b187a3-6c04-4c86-8fac-e6ca9c143834"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-055cad"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-b-055cad\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.142Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-055cad","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-b-055cad","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-055cad","uid":"32b187a3-6c04-4c86-8fac-e6ca9c143834"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-055cad"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-b-055cad\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.156Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cd24f2a83d9892f42bd9f264fe107d16c8cad8000932c1809b70b0f6a76d4f35","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cd24f2a83d9892f42bd9f264fe107d16c8cad8000932c1809b70b0f6a76d4f35"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cd24f2a83d9892f42bd9f264fe107d16c8cad8000932c1809b70b0f6a76d4f35\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.200Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-b-652268","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-b-652268\" not found"}
{"level":"error","ts":"2026-11-04T00:31:24.200Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-b-652268","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-b-652268\" not found"}
{"level":"error","ts":"2026-11-04T00:31:24.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dcd301acc6afb5154be0fbe714a4723bda4d23e92538f83315e13fd9a8b42f48","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dcd301acc6afb5154be0fbe714a4723bda4d23e92538f83315e13fd9a8b42f48"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dcd301acc6afb5154be0fbe714a4723bda4d23e92538f83315e13fd9a8b42f48\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.333Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"daf6d8bc7b689de427df63522c73bdf8c4ad9c6f5b1d5d03cbb46531edc7da0c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["daf6d8bc7b689de427df63522c73bdf8c4ad9c6f5b1d5d03cbb46531edc7da0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"daf6d8bc7b689de427df63522c73bdf8c4ad9c6f5b1d5d03cbb46531edc7da0c\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.403Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"513d387a5cfb90682c63f5e36e34ca382a9126e401331f4eb7ff0ad07530f556","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["513d387a5cfb90682c63f5e36e34ca382a9126e401331f4eb7ff0ad07530f556"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"513d387a5cfb90682c63f5e36e34ca382a9126e401331f4eb7ff0ad07530f556\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.487Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0fcd9b785f97c7725dac9558dbc40f3b5d4f89cc0041a8937740d3ddf78bb21e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0fcd9b785f97c7725dac9558dbc40f3b5d4f89cc0041a8937740d3ddf78bb21e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0fcd9b785f97c7725dac9558dbc40f3b5d4f89cc0041a8937740d3ddf78bb21e\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.567Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b15b5c40321b4535d7d882fef0c51bdeb0922cc394f666a7b05e4bdd6d691303","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b15b5c40321b4535d7d882fef0c51bdeb0922cc394f666a7b05e4bdd6d691303"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b15b5c40321b4535d7d882fef0c51bdeb0922cc394f666a7b05e4bdd6d691303\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.641Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"73792c591f1475071de05e7570dcac890b5753a9c4c078f6c13ef1dc976e884c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["73792c591f1475071de05e7570dcac890b5753a9c4c078f6c13ef1dc976e884c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"73792c591f1475071de05e7570dcac890b5753a9c4c078f6c13ef1dc976e884c\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.732Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e6e81548d23f77e504f9461fc5dd26367ddb71fc0a36ad84d8d407ca2eaf88f9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e6e81548d23f77e504f9461fc5dd26367ddb71fc0a36ad84d8d407ca2eaf88f9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e6e81548d23f77e504f9461fc5dd26367ddb71fc0a36ad84d8d407ca2eaf88f9\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.811Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"93aac10b7e5bd8d70fd96c807a5e9a5595af879d19e41086de28b60058cf0138","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["93aac10b7e5bd8d70fd96c807a5e9a5595af879d19e41086de28b60058cf0138"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"93aac10b7e5bd8d70fd96c807a5e9a5595af879d19e41086de28b60058cf0138\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.884Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"01ab7dc073848ce74d014146a7099b740595d045acfe9a2be38c49524691cc03","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01ab7dc073848ce74d014146a7099b740595d045acfe9a2be38c49524691cc03"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-ccd0bb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"01ab7dc073848ce74d014146a7099b740595d045acfe9a2be38c49524691cc03\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:24.962Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d89752f12f82cd814d90c9e8d60b3f32e3f316b5f90c26ff42637b860aca4c5a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d89752f12f82cd814d90c9e8d60b3f32e3f316b5f90c26ff42637b860aca4c5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-055cad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d89752f12f82cd814d90c9e8d60b3f32e3f316b5f90c26ff42637b860aca4c5a\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:25.025Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/447c45cfe535cebdba1569b188ac8d01ea48bf4440de85e5471892ef29868328","error":"authconfigs.authorino.kuadrant.io \"447c45cfe535cebdba1569b188ac8d01ea48bf4440de85e5471892ef29868328\" not found"}
{"level":"error","ts":"2026-11-04T00:31:25.080Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f00ca4c3c623c6b54203e5b2782293aaa98cc45e8b70c9c71380a15c889fe0ef","error":"authconfigs.authorino.kuadrant.io \"f00ca4c3c623c6b54203e5b2782293aaa98cc45e8b70c9c71380a15c889fe0ef\" not found"}
{"level":"error","ts":"2026-11-04T00:31:25.140Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6ae3f9b6d3ee9bbb21ed95202b119dea8564265b239e9f4a48b1208e3c45e26d","error":"authconfigs.authorino.kuadrant.io \"6ae3f9b6d3ee9bbb21ed95202b119dea8564265b239e9f4a48b1208e3c45e26d\" not found"}
{"level":"error","ts":"2026-11-04T00:31:25.196Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8b1e296a9fc2fbaff07b160ba509e8b5f544a0011cbbc92bd8d228490b881d38","error":"authconfigs.authorino.kuadrant.io \"8b1e296a9fc2fbaff07b160ba509e8b5f544a0011cbbc92bd8d228490b881d38\" not found"}
{"level":"error","ts":"2026-11-04T00:31:25.253Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e508970e46b5c8173360bad4867080e506db70c8e30a962be367cc217649f19c","error":"authconfigs.authorino.kuadrant.io \"e508970e46b5c8173360bad4867080e506db70c8e30a962be367cc217649f19c\" not found"}
{"level":"error","ts":"2026-11-04T00:31:25.310Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/80179e245c4697e5781a1b5750aa9314ad4e1b0d566f6532ba9600a0568e112a","error":"authconfigs.authorino.kuadrant.io \"80179e245c4697e5781a1b5750aa9314ad4e1b0d566f6532ba9600a0568e112a\" not found"}
{"level":"error","ts":"2026-11-04T00:31:25.312Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-055cad","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-b-055cad","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-055cad","uid":"32b187a3-6c04-4c86-8fac-e6ca9c143834"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd56c888b45e21658e0e61097f3c66d2af8824cce8cc1b5cb9e264b1852021f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"2711731f0da79b24f2d515bff72ec8d681ed5a68c3b6b83554ead276c6784c87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cd24f2a83d9892f42bd9f264fe107d16c8cad8000932c1809b70b0f6a76d4f35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"1e030dca808ebe5dc22d827a3e8ff466d207a9dff60d560aa555aa797e686837\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d89752f12f82cd814d90c9e8d60b3f32e3f316b5f90c26ff42637b860aca4c5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"8807facbcc462ca4c3db6f8c281f493006c18280281daf9bc7cc3fec19cd98c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93aac10b7e5bd8d70fd96c807a5e9a5595af879d19e41086de28b60058cf0138\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"1b3463cf937e6c19bd9a7b1ba837358fddc1f959932652e34e111567f317ec40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcd301acc6afb5154be0fbe714a4723bda4d23e92538f83315e13fd9a8b42f48\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"fdf5d8e44aadfbd6d66dc05737eaf9f1d50afce7c4be51b6aec3e301a2f376c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6e81548d23f77e504f9461fc5dd26367ddb71fc0a36ad84d8d407ca2eaf88f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"21e76615b5709ca2ed1f83dcf77434791b857a6034705cc46de324c94a85da88\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-055cad"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-055cad\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:25.382Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-ccd0bb","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-ccd0bb","uid":"b95911db-c81c-4a50-b054-a5bdb51c00e5"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"daf6d8bc7b689de427df63522c73bdf8c4ad9c6f5b1d5d03cbb46531edc7da0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-ccd0bb-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]}],\"name\":\"a1ad9b2554fcaef964a0f13fab31503ad12df76323f073021935ba4aa33b01c7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"513d387a5cfb90682c63f5e36e34ca382a9126e401331f4eb7ff0ad07530f556\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-ccd0bb-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]}],\"name\":\"75ce4b41e4f621f0f4b65a91f29699a8cd5aa07c3f7c206784774819ce7be587\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b15b5c40321b4535d7d882fef0c51bdeb0922cc394f666a7b05e4bdd6d691303\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-ccd0bb-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]}],\"name\":\"e93c1b193064e4d06d81aff60bab0603e4856db02b9898ab1184265a09f7c41a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01ab7dc073848ce74d014146a7099b740595d045acfe9a2be38c49524691cc03\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-ccd0bb-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]}],\"name\":\"a22ee7889eeeaca771c930f425af3a583048a2bde7dc201bafe4b6446dc3718f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0fcd9b785f97c7725dac9558dbc40f3b5d4f89cc0041a8937740d3ddf78bb21e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-ccd0bb-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]}],\"name\":\"ad2f7de8228291a517a382f567b3f2dc6f773c14a6235f9f045990d4d6329c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73792c591f1475071de05e7570dcac890b5753a9c4c078f6c13ef1dc976e884c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-ccd0bb-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d50375d5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-ccd0bb\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-ccd0bb\"]}],\"name\":\"bc4daddaf767af7ed8cbe9c9a9d0148c839e48430d25dca76a5617b818e8a14a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-ccd0bb"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-ccd0bb\" already exists"}
{"level":"error","ts":"2026-11-04T00:31:25.493Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-652268","envoyfilter":"openshift-ingress/kuadrant-e2e-ipp-b-652268","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-652268\" not found"}
{"level":"error","ts":"2026-11-04T00:31:25.674Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-ccd0bb-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-ccd0bb-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:25.729Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:25.854Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:25.894Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-652268-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-b-652268-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:31:25.931Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.060Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.193Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-e99a10","namespace":"openshift-ingress","uid":"dac188b1-7d08-4a80-a967-6f39d7e96875","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-e99a10\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.264Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-055cad","namespace":"openshift-ingress","uid":"1308781f-6ff3-46bb-b3f4-16bf73c0c6b5","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-055cad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.402Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.467Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.528Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress","uid":"7d776ff7-c7b3-4bf1-a16a-2057d08a3c46","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-ccd0bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.591Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.675Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-055cad-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-055cad-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.728Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.791Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.853Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-f989de","namespace":"openshift-ingress","uid":"1fd767ef-d69a-4b9a-93cb-507340599e70","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-f989de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.917Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-f080e1","namespace":"openshift-ingress","uid":"10a4651c-45e3-4b44-82ea-e80bf72f0444","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-f080e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:26.986Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:27.047Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:27.107Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:31:27.107Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:27.107Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:31:27.203Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-b-055cad","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-b-055cad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:27.439Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-b-ccd0bb","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-b-ccd0bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:27.602Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-055cad","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-055cad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:27.665Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-ccd0bb","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-ccd0bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:31:27.733Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-652268","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-b-652268\" not found"}
{"level":"info","ts":"2026-11-04T00:31:36.057Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","Gateway","EnvoyFilter","HTTPRoute","ConfigMap","Limitador"],"eventTypes":{"create":19,"delete":11,"update":25}}
{"level":"info","ts":"2026-11-04T00:31:36.403Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:38.016Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:31:38.149Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:31:38.149Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:41.140Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:31:41.153Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:41.162Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:31:41.162Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:41.224Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:41.224Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:41.234Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:31:43.805Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:43.805Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:31:44.432Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-f339f0","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-f339f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:31:44Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","reconcileID":"11a85e52-2382-446f-a1c6-b0bfb0230139","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:31:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:31:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","reconcileID":"346253d7-4f71-430d-84b4-237375e7fe5c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","reconcileID":"c783ac83-f43d-49a7-b255-01876ae8befe","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:31:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:31:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:31:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:31:46Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:31:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:31:51.531Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","TokenRateLimitPolicy","Gateway","ConfigMap","AuthPolicy","HTTPRoute"],"eventTypes":{"create":3,"update":22}}
{"level":"info","ts":"2026-11-04T00:31:51.802Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:51.822Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:54.661Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:54.865Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:31:55.062Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:31:55.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:31:55.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:58.073Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:31:58.080Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:58.083Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:31:58.083Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:31:58.113Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:31:58.114Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:31:58.202Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:01.103Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:01.103Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:09.093Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","Gateway","EnvoyFilter","HTTPRoute","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"create":10,"update":23}}
{"level":"info","ts":"2026-11-04T00:32:09.388Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:11.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:32:12.066Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:32:12.066Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:16.327Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:32:16.336Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:16.336Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:16.342Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:16.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:32:16.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:16.336Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:32:19.153Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:19.153Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","reconcileID":"158f2b7b-afa5-4c68-9843-b0c41ef43068","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:32:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","reconcileID":"0b166dd6-dd33-48a2-9b64-1d3e8319c426","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","reconcileID":"0b166dd6-dd33-48a2-9b64-1d3e8319c426"}
{"level":"error","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","reconcileID":"0b166dd6-dd33-48a2-9b64-1d3e8319c426","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-5f6eca\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","reconcileID":"f2e89a77-9661-4b6c-9448-915badeadef7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","reconcileID":"7da492f6-84c5-4679-b5e1-b6153edf2f8b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:32:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","reconcileID":"7da492f6-84c5-4679-b5e1-b6153edf2f8b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f080e1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f080e1","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-f080e1\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:32:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:27.394Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","AuthPolicy","Kuadrant","ConfigMap","Limitador","HTTPRoute"],"eventTypes":{"create":3,"delete":2,"update":23}}
{"level":"info","ts":"2026-11-04T00:32:27.698Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:27.718Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:30.162Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:32:30.425Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:32:30.425Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:30.445Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:30.646Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:32:33.559Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:32:33.560Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:33.628Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:32:33.629Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:32:33.648Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:33.648Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:33.784Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:32:33.840Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-a-f080e1","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-f080e1\" not found"}
{"level":"error","ts":"2026-11-04T00:32:33.840Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-a-f080e1","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-f080e1\" not found"}
{"level":"error","ts":"2026-11-04T00:32:34.282Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-f080e1","envoyfilter":"openshift-ingress/kuadrant-e2e-ipp-a-f080e1","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-f080e1\" not found"}
{"level":"error","ts":"2026-11-04T00:32:35.592Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-f080e1-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-a-f080e1-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T00:32:36.580Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:36.581Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:32:37.011Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-f080e1","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-a-f080e1\" not found"}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e99a10","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e99a10","reconcileID":"d9e5dfc5-02c5-4f4b-bc3a-a185157bcf89","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-e99a10","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e99a10","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e99a10","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e99a10","reconcileID":"d9e5dfc5-02c5-4f4b-bc3a-a185157bcf89","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-e99a10","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e99a10","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e99a10","reconcileID":"0326c5b6-c9f7-4d48-8d7a-b9b68bba5551","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-e99a10\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e99a10","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-e99a10\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:32:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:47.992Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","AuthConfig","EnvoyFilter","TokenRateLimitPolicy","Limitador","ConfigMap","AuthPolicy","Kuadrant"],"eventTypes":{"create":9,"delete":13,"update":24}}
{"level":"info","ts":"2026-11-04T00:32:48.395Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:48.416Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","reconcileID":"d9db4f7f-7312-4c53-877c-cfa6ea3bf3e4","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:32:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:32:49Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:32:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:50Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:32:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","reconcileID":"d9db4f7f-7312-4c53-877c-cfa6ea3bf3e4","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-055cad","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-055cad","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:32:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:32:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-055cad\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:32:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:51.029Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:32:51.040Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:32:51.128Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:32:51.128Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:51.219Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:54.521Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:32:54.532Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:54.532Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:54.541Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:54.541Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:32:54.547Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:32:54.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:32:54.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:32:54Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","reconcileID":"027cd143-80da-49b1-bd9a-b40b804bcb5f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:32:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:32:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:32:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:32:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:55Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","reconcileID":"6d72d614-f1e8-40f6-9c38-02663247c39d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:55Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","reconcileID":"6d72d614-f1e8-40f6-9c38-02663247c39d"}
{"level":"error","ts":"2026-11-04T00:32:55Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","reconcileID":"6d72d614-f1e8-40f6-9c38-02663247c39d","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:32:55Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","reconcileID":"e903b7f6-0081-4b0d-9225-93148f64edaa","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:32:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:32:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:32:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:32:57.206Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-055cad","namespace":"openshift-ingress","uid":"1308781f-6ff3-46bb-b3f4-16bf73c0c6b5","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-055cad\" not found"}
{"level":"info","ts":"2026-11-04T00:32:57.207Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:32:57.207Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:32:57.574Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-c893ec","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:32:57.635Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-055cad","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-055cad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:32:58.625Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","EnvoyFilter","Gateway"],"eventTypes":{"delete":5}}
{"level":"info","ts":"2026-11-04T00:33:00Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","reconcileID":"00b62290-c3b1-47b5-91c7-5eefd4d85357","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:33:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:33:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:33:00Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:33:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:33:01Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:33:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","reconcileID":"00b62290-c3b1-47b5-91c7-5eefd4d85357","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:33:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-ccd0bb","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:33:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:33:01Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-ccd0bb\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:33:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:33:03.771Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:33:03.779Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:03.779Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:33:03.813Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:03.813Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:33:03.820Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:33:03.940Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:33:03.940Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:33:04.025Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/848699431da3796bcf0c18e62c306ddac28a457f07a72baa3f108c15cb59923e","error":"authconfigs.authorino.kuadrant.io \"848699431da3796bcf0c18e62c306ddac28a457f07a72baa3f108c15cb59923e\" not found"}
{"level":"error","ts":"2026-11-04T00:33:04.080Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6bbe02c2b845886a45d02196afc01debf91ee9c5299b1982ca679370d90a7ac5","error":"authconfigs.authorino.kuadrant.io \"6bbe02c2b845886a45d02196afc01debf91ee9c5299b1982ca679370d90a7ac5\" not found"}
{"level":"error","ts":"2026-11-04T00:33:04.134Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/20398fdb196fef0ffb1f43948522d4799823b4dab54469fcbbede782dc7c995c","error":"authconfigs.authorino.kuadrant.io \"20398fdb196fef0ffb1f43948522d4799823b4dab54469fcbbede782dc7c995c\" not found"}
{"level":"error","ts":"2026-11-04T00:33:04.190Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/11a578d992d7dafd18acce6ca10c5a3a670848ad93983387fa2cdeefb4b70b93","error":"authconfigs.authorino.kuadrant.io \"11a578d992d7dafd18acce6ca10c5a3a670848ad93983387fa2cdeefb4b70b93\" not found"}
{"level":"error","ts":"2026-11-04T00:33:04.244Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/02eb7a30a7632ec8d14d22d6f1e0a77e616e840f2a0d5e74ba66a59a71d87093","error":"authconfigs.authorino.kuadrant.io \"02eb7a30a7632ec8d14d22d6f1e0a77e616e840f2a0d5e74ba66a59a71d87093\" not found"}
{"level":"error","ts":"2026-11-04T00:33:04.298Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1a0556cb11811ea4015eee8d0093aa8d088e70e723688c5e99d0d32dfb4f408b","error":"authconfigs.authorino.kuadrant.io \"1a0556cb11811ea4015eee8d0093aa8d088e70e723688c5e99d0d32dfb4f408b\" not found"}
{"level":"error","ts":"2026-11-04T00:33:04.530Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-055cad","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:31:12Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"32b187a3-6c04-4c86-8fac-e6ca9c143834\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:31:12Z"}],"name":"kuadrant-e2e-ipp-b-055cad","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-055cad","uid":"32b187a3-6c04-4c86-8fac-e6ca9c143834"}],"resourceVersion":"65401","uid":"dd78a11d-cffb-4c34-8af6-7158efbb2fbe"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd56c888b45e21658e0e61097f3c66d2af8824cce8cc1b5cb9e264b1852021f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"2711731f0da79b24f2d515bff72ec8d681ed5a68c3b6b83554ead276c6784c87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cd24f2a83d9892f42bd9f264fe107d16c8cad8000932c1809b70b0f6a76d4f35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"1e030dca808ebe5dc22d827a3e8ff466d207a9dff60d560aa555aa797e686837\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d89752f12f82cd814d90c9e8d60b3f32e3f316b5f90c26ff42637b860aca4c5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"8807facbcc462ca4c3db6f8c281f493006c18280281daf9bc7cc3fec19cd98c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93aac10b7e5bd8d70fd96c807a5e9a5595af879d19e41086de28b60058cf0138\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"1b3463cf937e6c19bd9a7b1ba837358fddc1f959932652e34e111567f317ec40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcd301acc6afb5154be0fbe714a4723bda4d23e92538f83315e13fd9a8b42f48\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"fdf5d8e44aadfbd6d66dc05737eaf9f1d50afce7c4be51b6aec3e301a2f376c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6e81548d23f77e504f9461fc5dd26367ddb71fc0a36ad84d8d407ca2eaf88f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-055cad-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ec6dcb2e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-055cad\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-055cad\"]}],\"name\":\"21e76615b5709ca2ed1f83dcf77434791b857a6034705cc46de324c94a85da88\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-055cad"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-055cad\" not found"}
{"level":"error","ts":"2026-11-04T00:33:05.654Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-055cad","namespace":"openshift-ingress","uid":"1308781f-6ff3-46bb-b3f4-16bf73c0c6b5","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-055cad\" not found"}
{"level":"error","ts":"2026-11-04T00:33:05.952Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-5f6eca-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-5f6eca-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:33:06.013Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-055cad-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-b-055cad-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:33:06.329Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-5f6eca","namespace":"openshift-ingress","uid":"708d910b-97c5-444c-a120-41370ed9f51e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-5f6eca\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:33:06.630Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-ccd0bb","namespace":"openshift-ingress","uid":"7d776ff7-c7b3-4bf1-a16a-2057d08a3c46","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-ccd0bb\" not found"}
{"level":"info","ts":"2026-11-04T00:33:06.813Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:06.814Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:33:07.080Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-055cad","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-b-055cad\" not found"}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","reconcileID":"31ced403-95d3-4a75-bfbb-776c3d44cdcc","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:33:07.226Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-ccd0bb","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-ccd0bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","reconcileID":"31ced403-95d3-4a75-bfbb-776c3d44cdcc","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-f989de","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:33:07.358Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-c893ec","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-f989de","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-f989de\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:33:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:33:07.550Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-f989de","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-f989de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:33:17.832Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","Gateway","Kuadrant","ConfigMap","AuthPolicy","Limitador","EnvoyFilter","AuthConfig"],"eventTypes":{"create":5,"delete":22,"update":7}}
{"level":"info","ts":"2026-11-04T00:33:18.168Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:18.189Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:20.820Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:33:20.957Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:33:20.957Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:33:20.957Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:33:21.047Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:33:23.949Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:23.956Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:33:23.961Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:23.961Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:33:23.949Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:33:24.014Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:33:24.062Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:33:24.102Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-a-f989de","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-f989de\" not found"}
{"level":"error","ts":"2026-11-04T00:33:24.102Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-a-f989de","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-f989de\" not found"}
{"level":"error","ts":"2026-11-04T00:33:24.475Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-f989de","envoyfilter":"openshift-ingress/kuadrant-e2e-ipp-a-f989de","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-f989de\" not found"}
{"level":"error","ts":"2026-11-04T00:33:25.803Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-f989de-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-a-f989de-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T00:33:27.049Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:27.049Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:33:27.777Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-f989de","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-a-f989de\" not found"}
{"level":"info","ts":"2026-11-04T00:33:28.464Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","reconcileID":"ff884dbc-ded7-4e5d-b627-7043ae221df7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","reconcileID":"ff884dbc-ded7-4e5d-b627-7043ae221df7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-f339f0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-f339f0","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-f339f0\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:33:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:33:33.761Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:33:33.768Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:33.768Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:33:33.813Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:33.813Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:33:33.820Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:33:33.833Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-c893ec","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-a-c893ec","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-c893ec","uid":"0e2c2340-9dbf-4bb8-8c88-ecc3d96cea96"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-c893ec"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-c893ec\" already exists"}
{"level":"error","ts":"2026-11-04T00:33:33.878Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:33:33.878Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:33:33.937Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-a-f989de","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-f989de\" not found"}
{"level":"error","ts":"2026-11-04T00:33:33.938Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-c893ec","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-a-c893ec","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-c893ec","uid":"0e2c2340-9dbf-4bb8-8c88-ecc3d96cea96"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-c893ec"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-c893ec\" already exists"}
{"level":"error","ts":"2026-11-04T00:33:33.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"da70a3cec781b9b752831b776c17424a7b73c319969a0eeca9bc3602e58662bf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["da70a3cec781b9b752831b776c17424a7b73c319969a0eeca9bc3602e58662bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"da70a3cec781b9b752831b776c17424a7b73c319969a0eeca9bc3602e58662bf\" already exists"}
{"level":"error","ts":"2026-11-04T00:33:33.992Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-a-f989de","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-f989de\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.012Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0c43a911d4e1832eb2906792a3b002f46374cd914a08828dab41a4a9e2ed949d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0c43a911d4e1832eb2906792a3b002f46374cd914a08828dab41a4a9e2ed949d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0c43a911d4e1832eb2906792a3b002f46374cd914a08828dab41a4a9e2ed949d\" already exists"}
{"level":"error","ts":"2026-11-04T00:33:34.084Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"78810bb3547f94a48c904adb9012d1b840e0836a0a03372e8132cd6ea6c2c840","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["78810bb3547f94a48c904adb9012d1b840e0836a0a03372e8132cd6ea6c2c840"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"78810bb3547f94a48c904adb9012d1b840e0836a0a03372e8132cd6ea6c2c840\" already exists"}
{"level":"error","ts":"2026-11-04T00:33:34.213Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"81f9eb37527d863a772d3b38c32825d183a00c2932e820eeaeda6350de5a0200","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["81f9eb37527d863a772d3b38c32825d183a00c2932e820eeaeda6350de5a0200"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"81f9eb37527d863a772d3b38c32825d183a00c2932e820eeaeda6350de5a0200\" already exists"}
{"level":"error","ts":"2026-11-04T00:33:34.290Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b0b0dfcc1da51a4d754ece5d535f25c8dc9773e0e473e6ac8f2d3007494c365c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b0b0dfcc1da51a4d754ece5d535f25c8dc9773e0e473e6ac8f2d3007494c365c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b0b0dfcc1da51a4d754ece5d535f25c8dc9773e0e473e6ac8f2d3007494c365c\" already exists"}
{"level":"error","ts":"2026-11-04T00:33:34.363Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2d98795b31813a250c3a1871d68eeffe7eba40260b30ea72c9163cd3c7eba46f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d98795b31813a250c3a1871d68eeffe7eba40260b30ea72c9163cd3c7eba46f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-c893ec.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2d98795b31813a250c3a1871d68eeffe7eba40260b30ea72c9163cd3c7eba46f\" already exists"}
{"level":"error","ts":"2026-11-04T00:33:34.419Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/531a1b4354760aa33afec3571cfe874ebae3be138792d271ce4d26eeeebc3c2d","error":"authconfigs.authorino.kuadrant.io \"531a1b4354760aa33afec3571cfe874ebae3be138792d271ce4d26eeeebc3c2d\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.474Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cb433efd70556466138d5f44ff0a53edb6eeef5b010f0cbdbe91f4521b54ea6b","error":"authconfigs.authorino.kuadrant.io \"cb433efd70556466138d5f44ff0a53edb6eeef5b010f0cbdbe91f4521b54ea6b\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.528Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/93aac10b7e5bd8d70fd96c807a5e9a5595af879d19e41086de28b60058cf0138","error":"authconfigs.authorino.kuadrant.io \"93aac10b7e5bd8d70fd96c807a5e9a5595af879d19e41086de28b60058cf0138\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.582Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b15b5c40321b4535d7d882fef0c51bdeb0922cc394f666a7b05e4bdd6d691303","error":"authconfigs.authorino.kuadrant.io \"b15b5c40321b4535d7d882fef0c51bdeb0922cc394f666a7b05e4bdd6d691303\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.637Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d89752f12f82cd814d90c9e8d60b3f32e3f316b5f90c26ff42637b860aca4c5a","error":"authconfigs.authorino.kuadrant.io \"d89752f12f82cd814d90c9e8d60b3f32e3f316b5f90c26ff42637b860aca4c5a\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.674Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-f339f0","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:31:59Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"f50c907b-a943-45e1-8b9d-32074aced910\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:31:59Z"}],"name":"kuadrant-e2e-ipp-b-f339f0","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-f339f0","uid":"f50c907b-a943-45e1-8b9d-32074aced910"}],"resourceVersion":"66639","uid":"5f6beb7f-c070-4295-912c-bd99738fca9a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"328c46a53785e25c3a686a0271b0068a0920483502586f3d15d026e217d79da6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-f339f0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]}],\"name\":\"1b5916502a585aa287c888968cb0b7e88028a164547b1c2cb5dd7829704621fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80bb2bf7fc880080cceaefd74ff8c8601705db6e37b991c741c19ec428a22966\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-f339f0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]}],\"name\":\"d86806368082be472cd0dc63835e24c7d8b47dacff3f88150afa6a5e99a226bf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c3fe3f7558c47d86d2596bd3705f8d7e519ff9e48828313a2b2a1c1b9da25aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-f339f0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]}],\"name\":\"a9b721b4d8ce729a0c5ba9f454766b1fdfa63205ad66307e7df25c89b7362072\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"587a4cbde6fcca060b9e7ee1b2b596086c6cd52034d947642d78b3102d1a0f97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-f339f0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]}],\"name\":\"1a6451e4aae53c3385b6f0c80b7786a75cbc13c668fd712109f3a15a38765854\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b15c94ebdba5f1a355dcff69d965012e70599226666bfddbdc2ca2a3b8a4c3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-f339f0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]}],\"name\":\"ee1d19f09426b1b2b48ecad1733ebf0d0e43bc27ef155452618493a5881c6643\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d4878879d87635c03c0948bae153eaa6b7a3603651e63e05b029a73293b4181\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-f339f0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c217f0ca\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-f339f0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-f339f0\"]}],\"name\":\"fdfef5894ac5cb84ecaa9f1d8d8525288a42cfbbf50adf4215c228d8c889a80a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-f339f0"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-f339f0\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.691Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e6e81548d23f77e504f9461fc5dd26367ddb71fc0a36ad84d8d407ca2eaf88f9","error":"authconfigs.authorino.kuadrant.io \"e6e81548d23f77e504f9461fc5dd26367ddb71fc0a36ad84d8d407ca2eaf88f9\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.748Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/01ab7dc073848ce74d014146a7099b740595d045acfe9a2be38c49524691cc03","error":"authconfigs.authorino.kuadrant.io \"01ab7dc073848ce74d014146a7099b740595d045acfe9a2be38c49524691cc03\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.803Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/73792c591f1475071de05e7570dcac890b5753a9c4c078f6c13ef1dc976e884c","error":"authconfigs.authorino.kuadrant.io \"73792c591f1475071de05e7570dcac890b5753a9c4c078f6c13ef1dc976e884c\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.857Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8551d46a3401dad76378ecd0fb6ef2795768d03ed8abb30c303eacf5bd6beb67","error":"authconfigs.authorino.kuadrant.io \"8551d46a3401dad76378ecd0fb6ef2795768d03ed8abb30c303eacf5bd6beb67\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.877Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-f989de","envoyfilter":"openshift-ingress/kuadrant-e2e-ipp-a-f989de","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-f989de\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.912Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cd24f2a83d9892f42bd9f264fe107d16c8cad8000932c1809b70b0f6a76d4f35","error":"authconfigs.authorino.kuadrant.io \"cd24f2a83d9892f42bd9f264fe107d16c8cad8000932c1809b70b0f6a76d4f35\" not found"}
{"level":"error","ts":"2026-11-04T00:33:34.944Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-c893ec","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-a-c893ec","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-c893ec","uid":"0e2c2340-9dbf-4bb8-8c88-ecc3d96cea96"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0b0dfcc1da51a4d754ece5d535f25c8dc9773e0e473e6ac8f2d3007494c365c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"e158a308de5eca2ece711d5db4d9ab7ca0bd50b7477fbe66549134108e86b6d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"78810bb3547f94a48c904adb9012d1b840e0836a0a03372e8132cd6ea6c2c840\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"3b9788bbab7466fb21e46bcc3479477cc4b439e1fe192b4a80f03e0fbfcc1c39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d98795b31813a250c3a1871d68eeffe7eba40260b30ea72c9163cd3c7eba46f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"37b21b7af45d9db186930208f2e618c8620b38f6fbb31049aa70c374e43da0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"da70a3cec781b9b752831b776c17424a7b73c319969a0eeca9bc3602e58662bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"e51124166e6da7894b262d8c6ff9c1d7252185b5b56b9e42895a52d7bbbc60a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"81f9eb37527d863a772d3b38c32825d183a00c2932e820eeaeda6350de5a0200\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"4098005464fa4c8787f4b89bf483871e8d53628bcd6495c5eee8ddcae4afbd0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0c43a911d4e1832eb2906792a3b002f46374cd914a08828dab41a4a9e2ed949d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"cb520c703fe17912cc5a4fd046e96886312bbe5b92cb3c443152779718dd8966\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-c893ec"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-c893ec\" already exists"}
{"level":"error","ts":"2026-11-04T00:33:34.966Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fd6c0b0d9263ff1a74aa0b659282abe92b4ea4ca2c04631094f6c6f9ffaaaad9","error":"authconfigs.authorino.kuadrant.io \"fd6c0b0d9263ff1a74aa0b659282abe92b4ea4ca2c04631094f6c6f9ffaaaad9\" not found"}
{"level":"error","ts":"2026-11-04T00:33:35.020Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/daf6d8bc7b689de427df63522c73bdf8c4ad9c6f5b1d5d03cbb46531edc7da0c","error":"authconfigs.authorino.kuadrant.io \"daf6d8bc7b689de427df63522c73bdf8c4ad9c6f5b1d5d03cbb46531edc7da0c\" not found"}
{"level":"error","ts":"2026-11-04T00:33:35.074Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dcd301acc6afb5154be0fbe714a4723bda4d23e92538f83315e13fd9a8b42f48","error":"authconfigs.authorino.kuadrant.io \"dcd301acc6afb5154be0fbe714a4723bda4d23e92538f83315e13fd9a8b42f48\" not found"}
{"level":"error","ts":"2026-11-04T00:33:35.135Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0fcd9b785f97c7725dac9558dbc40f3b5d4f89cc0041a8937740d3ddf78bb21e","error":"authconfigs.authorino.kuadrant.io \"0fcd9b785f97c7725dac9558dbc40f3b5d4f89cc0041a8937740d3ddf78bb21e\" not found"}
{"level":"error","ts":"2026-11-04T00:33:35.193Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f873b7d2a0c1daf304f20554d7df10e307b845de50174e498d42116dc455bc63","error":"authconfigs.authorino.kuadrant.io \"f873b7d2a0c1daf304f20554d7df10e307b845de50174e498d42116dc455bc63\" not found"}
{"level":"error","ts":"2026-11-04T00:33:35.247Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dd56c888b45e21658e0e61097f3c66d2af8824cce8cc1b5cb9e264b1852021f2","error":"authconfigs.authorino.kuadrant.io \"dd56c888b45e21658e0e61097f3c66d2af8824cce8cc1b5cb9e264b1852021f2\" not found"}
{"level":"error","ts":"2026-11-04T00:33:35.301Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d7cbc30890f9d0a5a9b5e87bc8c0e9365dab65b45394f7ea20588ef07eb984a9","error":"authconfigs.authorino.kuadrant.io \"d7cbc30890f9d0a5a9b5e87bc8c0e9365dab65b45394f7ea20588ef07eb984a9\" not found"}
{"level":"error","ts":"2026-11-04T00:33:35.356Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/513d387a5cfb90682c63f5e36e34ca382a9126e401331f4eb7ff0ad07530f556","error":"authconfigs.authorino.kuadrant.io \"513d387a5cfb90682c63f5e36e34ca382a9126e401331f4eb7ff0ad07530f556\" not found"}
{"level":"error","ts":"2026-11-04T00:33:35.505Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-c893ec-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-c893ec-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:33:35.644Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-f989de-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-a-f989de-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:33:36.026Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-f339f0-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-b-f339f0-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:33:36.159Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-f339f0","namespace":"openshift-ingress","uid":"d29a6935-2210-4947-bacb-806b86ed9ef1","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-f339f0\" not found"}
{"level":"error","ts":"2026-11-04T00:33:36.401Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-c893ec","namespace":"openshift-ingress","uid":"7cb83155-0507-4ed3-91d2-72b564ff3e64","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:33:36.653Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:36.653Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:33:36.786Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-f339f0","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-b-f339f0\" not found"}
{"level":"error","ts":"2026-11-04T00:33:37.076Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-f989de","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-a-f989de\" not found"}
{"level":"error","ts":"2026-11-04T00:33:37.138Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-c893ec","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:33:37.187Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-a-c893ec","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:33:44.504Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Kuadrant","AuthConfig","Gateway","ConfigMap","EnvoyFilter","HTTPRoute","Limitador","TokenRateLimitPolicy"],"eventTypes":{"create":11,"delete":30,"update":7}}
{"level":"info","ts":"2026-11-04T00:33:44.780Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:44.820Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:47.028Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:33:47.214Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:33:47.267Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:33:47.432Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:33:47.432Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:33:50.142Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:33:50.151Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:50.151Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:33:50.158Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:50.158Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:33:50.165Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:33:50.262Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:33:50.262Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:33:52.435Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:33:52.435Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:33:53.166Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-697182","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-697182\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:33:54Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","reconcileID":"855f4cf2-404a-466e-bbff-dea0da7a856d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:33:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:33:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","reconcileID":"c398b855-d9a0-4857-af47-7f9d8231d6a8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","reconcileID":"c398b855-d9a0-4857-af47-7f9d8231d6a8"}
{"level":"error","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","reconcileID":"c398b855-d9a0-4857-af47-7f9d8231d6a8","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-697182\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","reconcileID":"acab5a09-db07-4777-8dc7-547b12a99b5f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:33:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:33:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:33:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:33:56Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:33:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:00.181Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","Gateway","HTTPRoute","AuthPolicy","Kuadrant","ConfigMap","AuthConfig"],"eventTypes":{"create":4,"delete":6,"update":6}}
{"level":"info","ts":"2026-11-04T00:34:00.483Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:00.504Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:02.731Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:34:02.845Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:02.914Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:34:02.914Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:03.136Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:34:04Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","reconcileID":"8ab70994-0d6a-46c7-8bd0-08e9d7e9c263","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:34:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:05Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:34:05Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:34:05Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:34:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","reconcileID":"80ce530c-8136-4d41-a97a-286a83f33729","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:34:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:05.766Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:34:05.770Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:05.775Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:05.775Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:05.814Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:34:05.817Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:34:05.888Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","reconcileID":"28d07a85-b937-45fe-8609-1a5161f19fd1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:34:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:08.299Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:08.299Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:34:08.839Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-b69eac","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-b69eac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:34:16.268Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","Limitador","TokenRateLimitPolicy","ConfigMap","Gateway","Kuadrant","EnvoyFilter"],"eventTypes":{"create":12,"update":8}}
{"level":"info","ts":"2026-11-04T00:34:16.579Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:16.600Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:18Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-792431","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-792431","reconcileID":"f141550f-1e40-4fff-bd29-bd4b2b292fd9","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-792431","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-792431","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:34:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:19.260Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:34:19.349Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:34:19.349Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:19.556Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:19.568Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:34:20Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:34:20Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:34:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:20Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-792431","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-792431","reconcileID":"04cce96b-d0f3-4ca4-af7b-661551c16b75","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-792431","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-792431","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:34:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:34:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:34:21Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:34:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:23.438Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:34:23.448Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:23.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:34:23.459Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:34:23.464Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:23.464Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:34:23.608Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:34:23.608Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:26.050Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:26.050Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:34:26.880Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-792431","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-792431\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:34:34.137Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap","AuthPolicy","TokenRateLimitPolicy","Kuadrant","AuthConfig","HTTPRoute","Gateway","Limitador"],"eventTypes":{"create":12,"update":10}}
{"level":"info","ts":"2026-11-04T00:34:34.450Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:34.458Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:37.050Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:34:37.256Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:34:37.257Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:37.325Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:37.628Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:34:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b20934","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b20934","reconcileID":"2c457faf-b001-4297-b5f2-9feb0f273c4e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-b20934","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b20934","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:34:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:34:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:34:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:40Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b20934","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b20934","reconcileID":"33fe91c6-8629-4ea1-91f0-74ceb4f1775d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-b20934","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b20934","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:34:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:34:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:34:41Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:34:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:41.801Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:41.807Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:34:41.818Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:34:41.825Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:41.825Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:41.801Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:34:41.933Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:34:44.690Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:44.690Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:34:45.258Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-b20934","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-b20934\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","reconcileID":"55a7a3ea-4e91-4c27-b452-f3bef7b38345","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","reconcileID":"96cb111c-eff2-48a0-90ea-0411759c1267","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","reconcileID":"96cb111c-eff2-48a0-90ea-0411759c1267"}
{"level":"error","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","reconcileID":"96cb111c-eff2-48a0-90ea-0411759c1267","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-6990c5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:34:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","reconcileID":"a0db69e8-a6a0-4228-b996-0a8a67a95210","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:34:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:34:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:54Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:34:54Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:34:54Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:34:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:34:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:34:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:34:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:34:55Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:34:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:34:56.742Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","TokenRateLimitPolicy","EnvoyFilter","Kuadrant","ConfigMap","AuthPolicy","HTTPRoute","Limitador"],"eventTypes":{"create":12,"update":10}}
{"level":"info","ts":"2026-11-04T00:34:56.992Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:34:57.012Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:00.334Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:00.414Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:35:00.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:35:00.551Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:35:00.551Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:03.438Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:35:03.447Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:03.447Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:03.447Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:03.454Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:35:03.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:35:03.565Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:35:03.565Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:06.550Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:06.550Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:07.977Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","Kuadrant","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-04T00:35:08.179Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:08.208Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:11.334Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:11.530Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:35:11.751Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:35:11.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:35:11.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:15.250Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:35:15.253Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:15.260Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:35:15.261Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:35:15.317Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:15.317Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:35:15.368Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-b20934","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-praxis-a-b20934","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-b20934","uid":"793e17ce-e277-43a7-a3db-8d793a823f08"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-b20934"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-b20934\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.368Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-6990c5","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-b-6990c5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-6990c5","uid":"cca938f0-56eb-4f41-8819-bded94ce1cfb"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-6990c5"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-b-6990c5\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:35:15.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:35:15.375Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5c00e488ae1dcf0837abfd5b1beac072f490d015662edad57e75a3c94d1859a3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c00e488ae1dcf0837abfd5b1beac072f490d015662edad57e75a3c94d1859a3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5c00e488ae1dcf0837abfd5b1beac072f490d015662edad57e75a3c94d1859a3\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.430Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-6990c5","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-b-6990c5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-6990c5","uid":"cca938f0-56eb-4f41-8819-bded94ce1cfb"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-6990c5"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-b-6990c5\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.431Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-b20934","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-praxis-a-b20934","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-b20934","uid":"793e17ce-e277-43a7-a3db-8d793a823f08"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-b20934"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-b20934\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.449Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1a6883fee27b462102f5dc74a8681c6a941d89b41c7caa7a8c2fdf79f456fc2a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1a6883fee27b462102f5dc74a8681c6a941d89b41c7caa7a8c2fdf79f456fc2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1a6883fee27b462102f5dc74a8681c6a941d89b41c7caa7a8c2fdf79f456fc2a\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.525Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"913876879bf8f08fb41ca8870dbdaea73ead7036db906905a431fc15d8a47e6c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["913876879bf8f08fb41ca8870dbdaea73ead7036db906905a431fc15d8a47e6c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"913876879bf8f08fb41ca8870dbdaea73ead7036db906905a431fc15d8a47e6c\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.608Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a8a5a9bf45c4853ce3c1a72a3cfab543246dfdb051bda66b9edc0372ebbe2105","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8a5a9bf45c4853ce3c1a72a3cfab543246dfdb051bda66b9edc0372ebbe2105"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a8a5a9bf45c4853ce3c1a72a3cfab543246dfdb051bda66b9edc0372ebbe2105\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.694Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3bf9dcc59a2bf8e8b8897d1a9eda8f0be85a6b08981ebc66c637f6a69feb059b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3bf9dcc59a2bf8e8b8897d1a9eda8f0be85a6b08981ebc66c637f6a69feb059b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3bf9dcc59a2bf8e8b8897d1a9eda8f0be85a6b08981ebc66c637f6a69feb059b\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.814Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ca3d3f64496c9053e18dc234a27ba89c4f3f6db3b61f42bd4c9db7e2f355ab66","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ca3d3f64496c9053e18dc234a27ba89c4f3f6db3b61f42bd4c9db7e2f355ab66"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ca3d3f64496c9053e18dc234a27ba89c4f3f6db3b61f42bd4c9db7e2f355ab66\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.886Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b7aa258184719e7b41d15f307a2b1fa808280e1ae28ca040b5894e2e89355808","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b7aa258184719e7b41d15f307a2b1fa808280e1ae28ca040b5894e2e89355808"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b7aa258184719e7b41d15f307a2b1fa808280e1ae28ca040b5894e2e89355808\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:15.962Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"27dd5c806343f9c1bc5f9021b2232f2b65f17c1206dc1bfd49c6faef4198722d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["27dd5c806343f9c1bc5f9021b2232f2b65f17c1206dc1bfd49c6faef4198722d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"27dd5c806343f9c1bc5f9021b2232f2b65f17c1206dc1bfd49c6faef4198722d\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:16.035Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ab742ddaa7885ef7f93d2397f3ccadaf7bf2188621cf8bb61c2733b928835dba","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab742ddaa7885ef7f93d2397f3ccadaf7bf2188621cf8bb61c2733b928835dba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ab742ddaa7885ef7f93d2397f3ccadaf7bf2188621cf8bb61c2733b928835dba\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:16.109Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9992f96124a8d0167e941d9e2d3dd0ffd408fef7f73f1221be6adcefdbdc4a23","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9992f96124a8d0167e941d9e2d3dd0ffd408fef7f73f1221be6adcefdbdc4a23"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-b20934.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9992f96124a8d0167e941d9e2d3dd0ffd408fef7f73f1221be6adcefdbdc4a23\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:16.191Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"509a124c837f7da9f28d2bbcf15a56e24544b0fcb53dff6a44396fafd0f4f0a6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["509a124c837f7da9f28d2bbcf15a56e24544b0fcb53dff6a44396fafd0f4f0a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"509a124c837f7da9f28d2bbcf15a56e24544b0fcb53dff6a44396fafd0f4f0a6\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:16.199Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-6990c5","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-b-6990c5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-6990c5","uid":"cca938f0-56eb-4f41-8819-bded94ce1cfb"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca3d3f64496c9053e18dc234a27ba89c4f3f6db3b61f42bd4c9db7e2f355ab66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6990c5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]}],\"name\":\"f635db57c40ac213fbb5add89e27b45dfd972b743ad6d786b0bc836f81c49e54\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8a5a9bf45c4853ce3c1a72a3cfab543246dfdb051bda66b9edc0372ebbe2105\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6990c5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]}],\"name\":\"503fa0752a7a15f038bf1d928bca84b0bb82d287163d5a14d23ca581f0ab69ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7aa258184719e7b41d15f307a2b1fa808280e1ae28ca040b5894e2e89355808\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6990c5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]}],\"name\":\"96828e486023e6cf48f64fe33ec0474ced21d1e7f2248da81a7d821248519d5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6352f36f596f507ef4e2f3c4ab34caa551d027a02bdb6782584a423613057be0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6990c5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]}],\"name\":\"85f88994595c3e3f0eef688f12a0b6e2fca716cb3d8332bfe6152bb0886b6f30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c00e488ae1dcf0837abfd5b1beac072f490d015662edad57e75a3c94d1859a3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6990c5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]}],\"name\":\"a68ac29309b9fc71b1745f4c864562f390267249db29e147db9c1e46f2765aac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"509a124c837f7da9f28d2bbcf15a56e24544b0fcb53dff6a44396fafd0f4f0a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6990c5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5231e3bb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-6990c5\"]}],\"name\":\"d0354c964b651a0aff7d786b39fa69e6aa3e611281e7cb6487f68862506a715f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-6990c5"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-6990c5\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:16.264Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6990c5#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6352f36f596f507ef4e2f3c4ab34caa551d027a02bdb6782584a423613057be0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6352f36f596f507ef4e2f3c4ab34caa551d027a02bdb6782584a423613057be0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6990c5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6352f36f596f507ef4e2f3c4ab34caa551d027a02bdb6782584a423613057be0\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:16.612Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-b20934","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-praxis-a-b20934","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-b20934","uid":"793e17ce-e277-43a7-a3db-8d793a823f08"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9992f96124a8d0167e941d9e2d3dd0ffd408fef7f73f1221be6adcefdbdc4a23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-b20934-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]}],\"name\":\"834c3384f41dbfec157776c377e68cbbf77f2ac7a231bffdf0547586e4114429\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3bf9dcc59a2bf8e8b8897d1a9eda8f0be85a6b08981ebc66c637f6a69feb059b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-b20934-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]}],\"name\":\"3bb85d63084e96941b8c88445795d15a60410c554ff57e8ecb3a43cbe88c49ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"913876879bf8f08fb41ca8870dbdaea73ead7036db906905a431fc15d8a47e6c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-b20934-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]}],\"name\":\"b6fe2f5d784db18a1298ef40a1107fa593fbca54f12b0039bb53fd93f00c6142\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab742ddaa7885ef7f93d2397f3ccadaf7bf2188621cf8bb61c2733b928835dba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-b20934-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]}],\"name\":\"aae591e4924786957e49069d7662743b6a629c379a90c90084b596edd47fde78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"27dd5c806343f9c1bc5f9021b2232f2b65f17c1206dc1bfd49c6faef4198722d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-b20934-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]}],\"name\":\"7f2f6b2ae257c60fbc11ce9e6a858da4e5e6f0bcecb3a8e889928eb9a3238446\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a6883fee27b462102f5dc74a8681c6a941d89b41c7caa7a8c2fdf79f456fc2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-b20934-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d2cead26\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-b20934\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-b20934\"]}],\"name\":\"183c3aaf1dba693ed91b9264cbfe6f00eb38acdad55546461b1a86de2310461d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-b20934"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-b20934\" already exists"}
{"level":"error","ts":"2026-11-04T00:35:16.822Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-792431-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-b-792431-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:35:17.136Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-b20934-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-b20934-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:35:17.181Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-6990c5","namespace":"openshift-ingress","uid":"b5e2cfd0-d2aa-4ef3-8bb1-2ac88914121b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-6990c5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:35:17.436Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-792431","namespace":"openshift-ingress","uid":"1937e18d-a235-48b3-882b-f67b7c8546f0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-792431\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:35:17.498Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-b20934","namespace":"openshift-ingress","uid":"805a7829-027d-4674-9ae1-a99bafbb90f2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-b20934\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:35:17.805Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-6990c5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-6990c5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:35:18.270Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:18.270Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:35:18.425Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-praxis-a-b20934","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-praxis-a-b20934\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:35:18.513Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-b20934","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-b20934\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:35:18.927Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-b-6990c5","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-b-6990c5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:35:19.193Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-6990c5","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-6990c5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:35:26.694Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","EnvoyFilter","TokenRateLimitPolicy","Limitador","AuthPolicy","HTTPRoute","ConfigMap"],"eventTypes":{"create":20,"update":12}}
{"level":"info","ts":"2026-11-04T00:35:27.040Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:28.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:35:28.926Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:35:28.926Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:32.527Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:35:32.537Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:32.537Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:32.539Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:35:32.549Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:32.555Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:35:32.732Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:35.524Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:35.524Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:43.642Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","AuthPolicy","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-11-04T00:35:43.993Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:45.565Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:35:45.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:35:45.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:48.839Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:35:48.850Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:48.850Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:48.859Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:48.859Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:35:48.864Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:35:48.864Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:35:51.755Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:35:51.755Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:00.195Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Gateway","Limitador"],"eventTypes":{"create":1,"update":21}}
{"level":"info","ts":"2026-11-04T00:36:00.437Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:02.324Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:36:02.514Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:36:02.514Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:04Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","reconcileID":"bb76b283-90ab-4641-bac4-9122936e7285","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:36:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:36:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:36:04Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:36:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:36:04Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:36:04Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","reconcileID":"bb76b283-90ab-4641-bac4-9122936e7285","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-5f6eca","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:36:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-5f6eca","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:36:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:36:05Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-5f6eca\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:36:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:36:05.941Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:36:05.952Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:05.952Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:05.955Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:05.956Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:36:05.962Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:36:05.962Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:36:08.563Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-5f6eca","namespace":"openshift-ingress","uid":"708d910b-97c5-444c-a120-41370ed9f51e","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-5f6eca\" not found"}
{"level":"info","ts":"2026-11-04T00:36:08.998Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:08.998Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:36:09.213Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-5f6eca","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-5f6eca\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:09.938Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-c893ec","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:36:17.288Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter","HTTPRoute","Kuadrant","Gateway","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":1,"delete":4,"update":4}}
{"level":"info","ts":"2026-11-04T00:36:17.498Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:17.507Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:19Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","reconcileID":"ef73bb51-93b6-4673-9943-a1751b6df710","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:36:19Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:36:19Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:36:20.952Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:20.953Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:36:20.959Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:36:21.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:36:21.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:36:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:36:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:36:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","reconcileID":"93e7c877-2f1f-4f6c-8f83-5fd6e4361ee5","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:36:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:36:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:36:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:36:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:36:22Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:36:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:36:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","reconcileID":"60b76616-9ebe-4cf5-9d78-9050b9dc57c0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:36:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:36:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:36:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:36:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:36:24Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:36:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:36:24.538Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:36:24.547Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:24.548Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:24.548Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:24.553Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:36:24.554Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:36:24.683Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:27.492Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:27.492Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:36:27.714Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-93a388","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-93a388\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:27.774Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-4cef7f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-4cef7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:36:28Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-93a388","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-93a388","reconcileID":"65c0546b-d167-4623-85d9-43e005d92bec","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-93a388","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:36:29.032Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter"],"eventTypes":{"delete":3}}
{"level":"info","ts":"2026-11-04T00:36:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-93a388","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:36:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-792431","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-792431","reconcileID":"c0edacfa-7467-4dbc-b2ac-43454ccd8623","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-792431","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-792431","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-792431","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-792431","reconcileID":"c0edacfa-7467-4dbc-b2ac-43454ccd8623","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-792431","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-93a388","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-93a388","reconcileID":"fe0a3b31-4516-46f0-870e-107c8353c525","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-93a388","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-93a388","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:36:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:36:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:36:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:36:32Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:36:32Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-792431","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-792431","reconcileID":"c542850a-bec7-4335-891c-ee62605e5e14","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-792431\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-792431","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:36:32Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-792431\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:36:33.835Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:33.835Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:36:34.310Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-c893ec","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:33:24Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"0e2c2340-9dbf-4bb8-8c88-ecc3d96cea96\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:33:24Z"}],"name":"kuadrant-e2e-ipp-a-c893ec","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-c893ec","uid":"0e2c2340-9dbf-4bb8-8c88-ecc3d96cea96"}],"resourceVersion":"69730","uid":"ad7e6eab-f5b9-43c7-a69d-6fdb1a196309"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"b7a6f93ef78c8c1ac1abd17a6ac5dd7e99b6268aead4ea506ec30fcf7ada4107\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"ce7f4f69604809bea8aa5751a4c75f06ea03ed01ad44a6ed9918f33d63e3fb47\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"4d9ec91544321e173796b43801474fc919ae8a776faf71359ab40f7a78764952\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"6fc5e1314e8048c56cdfe3a94ecaead4f4496bf601e94f19ab88b122fa8134d7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"d5117346ebc1f238c6696457a805510e2d4a126772b1a3c1118a15e1e507ec80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"2c60abead93bd04ef8e5c83f18fccf5263911dcb9bfb5e11e921c831e98828d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"869d692c92959a0546acab4771e9dfdfbcb06a13cf1365fb929399e6364a4e1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"e1a611f3c199cb462d34967d2e92873382dc73dd343631806ac536bcba9f2ba1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0b0dfcc1da51a4d754ece5d535f25c8dc9773e0e473e6ac8f2d3007494c365c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"e158a308de5eca2ece711d5db4d9ab7ca0bd50b7477fbe66549134108e86b6d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a18ca285b397dc86301cc8f64b98e30717d0cc58b923ddc3f15ff63c331fb287\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"f9322bbae5e61862baaaf67dc0788801e26bd0a340b013dbb0397817a0bb50a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6bcbfe7235a846da224046cbdbb1b97899a7c3b04854c0682ea43d086d6dc94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"5cbf70011375d2fadd7307afb0215dda6b4699a42bfdbd03f2efb47251822393\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7087af63cdd73f2399d08f8e879c80406f9a76f61ee83c0440ce37946aaf0e8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"01b705def7d03dd41c9ffd1c29b09c657e710671e5504bf955f6e96c2be6203c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b1d5dca463c280131e48f71bad53c207c9d3c1b7ab212797adc7927007df46a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"6c8af7e8081800d38d4a68bbd5459170565e1ce42dc129260df4fc4f8ff75be0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3d007c39bd9fddc21cbd655ee4cee5f292b5eeca03e168789bb432ec059fa66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"a8ca4940439007bd739632b536ef8b5be48a3bd56aebe77406723d59e5f1b40e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13a9e6be1e5bc36b79cbf292d44379b6898b96fdfef73c1823239feb634bee3b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"f87bb254d1eb3d0e2f840a63122d9e9a168d9b08f80f8a14e6f46bd8dff20d9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"30c3164627caac6ab0e1f6e5031dbf8128b15abece8e3854ee898dec8121a19b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"feee623051c5cf6a1876940cdd24e036df23a89b189ccef591fd9302b3f37bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"61bc628126cb52be474537dddaf1f5fd75808e137696526d77175a1c046058f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"af1bfc8b273c3ff5e5a810d05f7f47e90d3a2722a041dd2e7524e4d05c40fefc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad2097edbec6e2da243da0e55a5dcc286cc17c67d3beedbe5bc15431d0664778\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"d6cff1724b2ff8c1747241d8e439f9614328f1ae1471ea2ee64233a7eaa4c8c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"674f9e5232871fd840ae70650b877584ff801ff34b3a2e9c8080979050efecc0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"6c352e6389405337c7c8840a0717b8ade0b6c93ca26d400e9f39660458d079c7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"78810bb3547f94a48c904adb9012d1b840e0836a0a03372e8132cd6ea6c2c840\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"3b9788bbab7466fb21e46bcc3479477cc4b439e1fe192b4a80f03e0fbfcc1c39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d98795b31813a250c3a1871d68eeffe7eba40260b30ea72c9163cd3c7eba46f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"37b21b7af45d9db186930208f2e618c8620b38f6fbb31049aa70c374e43da0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"da70a3cec781b9b752831b776c17424a7b73c319969a0eeca9bc3602e58662bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"e51124166e6da7894b262d8c6ff9c1d7252185b5b56b9e42895a52d7bbbc60a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"81f9eb37527d863a772d3b38c32825d183a00c2932e820eeaeda6350de5a0200\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"4098005464fa4c8787f4b89bf483871e8d53628bcd6495c5eee8ddcae4afbd0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0c43a911d4e1832eb2906792a3b002f46374cd914a08828dab41a4a9e2ed949d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"cb520c703fe17912cc5a4fd046e96886312bbe5b92cb3c443152779718dd8966\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1601db498b8b8178adbdb4ca9788101365a3d96015c40d2165256c172c46ceea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"b5f300dda76c4e94a8e9cba88eb0ec1b35c8da31197739902f7b9c265bdf6eee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-c893ec"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:35.360Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:35.419Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:35.477Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:35.597Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-697182","namespace":"openshift-ingress","uid":"6d72df5a-d41e-49f5-ab27-bced33417c60","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-697182\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:35.718Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-6990c5","namespace":"openshift-ingress","uid":"b5e2cfd0-d2aa-4ef3-8bb1-2ac88914121b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-6990c5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:35.837Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:35.898Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:35.957Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.016Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.051Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-c893ec-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-c893ec-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.078Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.202Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-b20934","namespace":"openshift-ingress","uid":"805a7829-027d-4674-9ae1-a99bafbb90f2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-b20934\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.323Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-c893ec","namespace":"openshift-ingress","uid":"7cb83155-0507-4ed3-91d2-72b564ff3e64","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.380Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-792431","namespace":"openshift-ingress","uid":"1937e18d-a235-48b3-882b-f67b7c8546f0","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-792431\" not found"}
{"level":"error","ts":"2026-11-04T00:36:36.439Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.498Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-b69eac","namespace":"openshift-ingress","uid":"c81be07c-2150-4891-980b-8f300f9b121d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-b69eac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.557Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.616Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:36:36.675Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:36:47.103Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","TokenRateLimitPolicy","Limitador","Kuadrant","Gateway","AuthPolicy","HTTPRoute","ConfigMap"],"eventTypes":{"create":18,"delete":8,"update":27}}
{"level":"info","ts":"2026-11-04T00:36:47.457Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:47.477Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:50.153Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:50.350Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:36:50.461Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:36:50.652Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:36:50.653Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:53.728Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:36:53.735Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:53.738Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:53.738Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:53.742Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:36:53.744Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:36:53.846Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:36:53.846Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:36:55.951Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:36:56.848Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:36:56.848Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:36:58.466Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthPolicy","Gateway"],"eventTypes":{"delete":5}}
{"level":"info","ts":"2026-11-04T00:37:04Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","reconcileID":"f43bb0f9-c084-480d-b8f5-e027a877d47e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:37:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:37:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:37:04.630Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:37:04.640Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:04.640Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:37:04.646Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:04.647Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:37:04.657Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:37:04.728Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-93a388","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-praxis-b-93a388","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-93a388","uid":"15bf5561-91db-48d3-9834-377ff27ab4b0"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-93a388"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-93a388\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:04.761Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:37:04.761Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:37:04.761Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-93a388","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-praxis-b-93a388","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-93a388","uid":"15bf5561-91db-48d3-9834-377ff27ab4b0"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-93a388"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-b-93a388\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:04.833Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-4cef7f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-praxis-b-4cef7f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-4cef7f","uid":"e2d5f1dd-6d30-4c7b-871e-4e02517b931d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-4cef7f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-b-4cef7f\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:04.833Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7d81311de9c1c515eddfa6cd7fa66b172b76028c6a6131122bf6a62a8f045078","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d81311de9c1c515eddfa6cd7fa66b172b76028c6a6131122bf6a62a8f045078"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7d81311de9c1c515eddfa6cd7fa66b172b76028c6a6131122bf6a62a8f045078\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:04.837Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-4cef7f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-praxis-b-4cef7f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-4cef7f","uid":"e2d5f1dd-6d30-4c7b-871e-4e02517b931d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-4cef7f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-4cef7f\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:04.914Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2c1883b95059b6beae9d79f8222d241684b419169bbe6efc67f25b545ea00e5f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2c1883b95059b6beae9d79f8222d241684b419169bbe6efc67f25b545ea00e5f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2c1883b95059b6beae9d79f8222d241684b419169bbe6efc67f25b545ea00e5f\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:05.014Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dd6a464aa19dc14981275b6d76cb8573e9b5549f5c5a2f6613a64154c94ad32b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd6a464aa19dc14981275b6d76cb8573e9b5549f5c5a2f6613a64154c94ad32b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dd6a464aa19dc14981275b6d76cb8573e9b5549f5c5a2f6613a64154c94ad32b\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:05.085Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ffaf78c0911c0cce818a05e9d8899131bc09ba9ffcd91f384698d15b50a0fe6d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ffaf78c0911c0cce818a05e9d8899131bc09ba9ffcd91f384698d15b50a0fe6d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ffaf78c0911c0cce818a05e9d8899131bc09ba9ffcd91f384698d15b50a0fe6d\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:05.156Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"edb245b1b63430abaa79db8793555a1b4f94c1732f59d6e3e9a24bc959437794","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["edb245b1b63430abaa79db8793555a1b4f94c1732f59d6e3e9a24bc959437794"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"edb245b1b63430abaa79db8793555a1b4f94c1732f59d6e3e9a24bc959437794\" already exists"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"error","ts":"2026-11-04T00:37:05.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2eaf26f1ab6d64b6debb6b919567b01da727f535d4bdd82b3513bceae12347b6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2eaf26f1ab6d64b6debb6b919567b01da727f535d4bdd82b3513bceae12347b6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2eaf26f1ab6d64b6debb6b919567b01da727f535d4bdd82b3513bceae12347b6\" already exists"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","reconcileID":"2c16c3e6-e0ca-4c18-a392-9210e0ffad7a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:37:05.299Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f2a3314e7ff8575da75b1c7fb536efb2a98189c1d7a58e254bfb3659a9758ad6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f2a3314e7ff8575da75b1c7fb536efb2a98189c1d7a58e254bfb3659a9758ad6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f2a3314e7ff8575da75b1c7fb536efb2a98189c1d7a58e254bfb3659a9758ad6\" already exists"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:37:05.356Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-93a388","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-praxis-b-93a388","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-93a388","uid":"15bf5561-91db-48d3-9834-377ff27ab4b0"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd6a464aa19dc14981275b6d76cb8573e9b5549f5c5a2f6613a64154c94ad32b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-93a388-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]}],\"name\":\"27b3e38808780517ffb65be68d01fbe2d2dfb0d76b76edf2f75b45a87d6f3051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79948b9f150fd820df62b6b0be09103f62dde34407537d222dbee0b7d0f297e7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-93a388-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]}],\"name\":\"e613a0e84254f35053c6a83dc7f20d8be56a88983f4abfe7b457879a41661f9a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03f56b48d109c78e7b823b9c08f07a0d3f08cb8159bfcb809416d5a788cf0117\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-93a388-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]}],\"name\":\"be6aaa936c2384a6951262e6773869b21000efb5bfe1e01110a38419b9d2b3b3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d81311de9c1c515eddfa6cd7fa66b172b76028c6a6131122bf6a62a8f045078\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-93a388-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]}],\"name\":\"396259b94184e33ba6ac75ee09d2d4bed0668ad26f27205f6b92228d3ee2c679\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85fd95b16011eb6ea7c7f832971e8706baddf9c21798e1b9d385af4bc78f7f65\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-93a388-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]}],\"name\":\"30938a76a4870c52072c4dfd6a81f0957edd7eb334afed38ca3410e6e32c2371\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c1883b95059b6beae9d79f8222d241684b419169bbe6efc67f25b545ea00e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-93a388-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f509fce8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-93a388\"]}],\"name\":\"9aaa20209780e1a297e74a9d3c33200c868a063f0fcfad7c14ff0f693c0ee262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-93a388"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-93a388\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:05.373Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"03f56b48d109c78e7b823b9c08f07a0d3f08cb8159bfcb809416d5a788cf0117","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["03f56b48d109c78e7b823b9c08f07a0d3f08cb8159bfcb809416d5a788cf0117"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"03f56b48d109c78e7b823b9c08f07a0d3f08cb8159bfcb809416d5a788cf0117\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:05.450Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"744d9e4b7b1234bf41df3e2c9a677909ac2908affb49bbfac1a776f5ae8aefd0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["744d9e4b7b1234bf41df3e2c9a677909ac2908affb49bbfac1a776f5ae8aefd0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"744d9e4b7b1234bf41df3e2c9a677909ac2908affb49bbfac1a776f5ae8aefd0\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:05.521Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"438aab120f6f610485cdf4cc218703bc6ef09935bf47a5dcbc576bd2507871f0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["438aab120f6f610485cdf4cc218703bc6ef09935bf47a5dcbc576bd2507871f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-4cef7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"438aab120f6f610485cdf4cc218703bc6ef09935bf47a5dcbc576bd2507871f0\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:05.609Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"85fd95b16011eb6ea7c7f832971e8706baddf9c21798e1b9d385af4bc78f7f65","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["85fd95b16011eb6ea7c7f832971e8706baddf9c21798e1b9d385af4bc78f7f65"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"85fd95b16011eb6ea7c7f832971e8706baddf9c21798e1b9d385af4bc78f7f65\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:05.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-93a388#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"79948b9f150fd820df62b6b0be09103f62dde34407537d222dbee0b7d0f297e7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["79948b9f150fd820df62b6b0be09103f62dde34407537d222dbee0b7d0f297e7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-93a388.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"79948b9f150fd820df62b6b0be09103f62dde34407537d222dbee0b7d0f297e7\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:05.750Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8d658334faf6296c0e828aa40ddf0afa45276f7ed4efa4da6b55840e30a7d868","error":"authconfigs.authorino.kuadrant.io \"8d658334faf6296c0e828aa40ddf0afa45276f7ed4efa4da6b55840e30a7d868\" not found"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"error","ts":"2026-11-04T00:37:05.804Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2a511fb2f93999195973285e5725af1fd4260d6c229b6570e086a044334c2e2c","error":"authconfigs.authorino.kuadrant.io \"2a511fb2f93999195973285e5725af1fd4260d6c229b6570e086a044334c2e2c\" not found"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","reconcileID":"aa4371a5-d751-484c-a302-ad271671adfa","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:37:05.859Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e98657be05ce38819493864320ba8fec21f6d7c89729f1b5e02504cad44dbd8d","error":"authconfigs.authorino.kuadrant.io \"e98657be05ce38819493864320ba8fec21f6d7c89729f1b5e02504cad44dbd8d\" not found"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:37:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:37:05.913Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f115552d6d14e4570bf57429f9fddbcdc4e6296d60a4cc5d914f7a8665766263","error":"authconfigs.authorino.kuadrant.io \"f115552d6d14e4570bf57429f9fddbcdc4e6296d60a4cc5d914f7a8665766263\" not found"}
{"level":"error","ts":"2026-11-04T00:37:06.014Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/76393406a5a3e62814c4f6c2cd2121dbdd9bd38570d539f896aeb2413c462a2f","error":"authconfigs.authorino.kuadrant.io \"76393406a5a3e62814c4f6c2cd2121dbdd9bd38570d539f896aeb2413c462a2f\" not found"}
{"level":"error","ts":"2026-11-04T00:37:06.072Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/72d590a26723db5764014173c24ef6098f200f9bbe01d0baffe96d4d0adffc24","error":"authconfigs.authorino.kuadrant.io \"72d590a26723db5764014173c24ef6098f200f9bbe01d0baffe96d4d0adffc24\" not found"}
{"level":"error","ts":"2026-11-04T00:37:06.200Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-4cef7f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-praxis-b-4cef7f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-4cef7f","uid":"e2d5f1dd-6d30-4c7b-871e-4e02517b931d"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"744d9e4b7b1234bf41df3e2c9a677909ac2908affb49bbfac1a776f5ae8aefd0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-4cef7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]}],\"name\":\"547c7f6adbfe00a3aecfa76343db808c04b9c05d72c7509cdfae5b91bffffa03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2eaf26f1ab6d64b6debb6b919567b01da727f535d4bdd82b3513bceae12347b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-4cef7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]}],\"name\":\"f878968295cb302a6798e7978bfe8a0d9944531cfb01453895a0ad6272e23e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2a3314e7ff8575da75b1c7fb536efb2a98189c1d7a58e254bfb3659a9758ad6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-4cef7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]}],\"name\":\"3bf9acec2cb95050b2fd7498935dd1ecef191208a120934c7e52bad9e9e717cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edb245b1b63430abaa79db8793555a1b4f94c1732f59d6e3e9a24bc959437794\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-4cef7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]}],\"name\":\"5671b12f488360cae8e866806d10e4e0a0ccdd77612e0fa99fc8cb5d8738430f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"438aab120f6f610485cdf4cc218703bc6ef09935bf47a5dcbc576bd2507871f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-4cef7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]}],\"name\":\"4f17f82d54a4b3f18d57a604cd85ee791d462f2faf85ec6c36d52f8a9ea3a313\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ffaf78c0911c0cce818a05e9d8899131bc09ba9ffcd91f384698d15b50a0fe6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-4cef7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bd4911b9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-4cef7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-4cef7f\"]}],\"name\":\"319a817acf9df95b13501a2fa65489e1a96100053a54599451e70a9eb8ecb387\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-4cef7f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-4cef7f\" already exists"}
{"level":"error","ts":"2026-11-04T00:37:06.324Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:37:06Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:37:06Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:37:06Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:37:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:37:06.728Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-93a388-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-b-93a388-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:37:06.951Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-4cef7f","namespace":"openshift-ingress","uid":"9e46bde5-666e-4f03-9164-7868a756653e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-4cef7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:37:07.199Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-4cef7f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-b-4cef7f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:37:07.267Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-c893ec-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-c893ec-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:37:07.326Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-93a388","namespace":"openshift-ingress","uid":"f991d5e9-ae69-4664-bb43-899582bbc2ea","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-93a388\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:37:07.766Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:07.766Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:37:08.212Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-praxis-b-4cef7f","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-praxis-b-4cef7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:37:08.408Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-praxis-b-93a388","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-praxis-b-93a388\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:37:08.565Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-4cef7f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-4cef7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:37:08.694Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-e62743","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-e62743\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:37:08.820Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-93a388","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-93a388\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:37:16.601Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","Kuadrant","HTTPRoute","AuthConfig","Gateway","ConfigMap","TokenRateLimitPolicy","EnvoyFilter","AuthPolicy"],"eventTypes":{"create":21,"delete":6,"update":15}}
{"level":"info","ts":"2026-11-04T00:37:17.008Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:17.028Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:20.152Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:37:20.257Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:37:20.355Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:37:20.527Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:37:20.527Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:37:23.669Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:37:23.673Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:23.681Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:37:23.681Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:23.681Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:37:23.682Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:37:23.849Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:37:25.990Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-c893ec-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-c893ec-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:37:27.066Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:37:27.067Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:27.067Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:37:35.558Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Gateway","EnvoyFilter","AuthConfig","HTTPRoute","ConfigMap","Limitador"],"eventTypes":{"create":9,"update":14}}
{"level":"info","ts":"2026-11-04T00:37:35.911Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:38.859Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:37:39.034Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:37:39.035Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:37:44.091Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:37:44.091Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:44.123Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:37:44.123Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:37:44.124Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:37:44.136Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:44.136Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:37:46.088Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:37:47.603Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:47.603Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:37:48.566Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-697182","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-697182\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:37:55.792Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","TokenRateLimitPolicy","AuthConfig","EnvoyFilter","Gateway","AuthPolicy","ConfigMap","Limitador"],"eventTypes":{"create":1,"update":44}}
{"level":"info","ts":"2026-11-04T00:37:56.191Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:37:58.325Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:37:58.541Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:37:58.541Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:38:02.024Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:38:02.034Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:02.046Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:38:02.114Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:38:02.116Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:02.116Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:38:02.195Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:38:04.034Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:38:05.473Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:38:05.602Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:05.602Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:38:17.871Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","ConfigMap","AuthPolicy","EnvoyFilter","HTTPRoute","Limitador"],"eventTypes":{"create":12,"update":27}}
{"level":"info","ts":"2026-11-04T00:38:18.274Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:20.026Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:38:20.149Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:38:20.149Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:38:23.849Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:38:23.934Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:23.943Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:38:23.959Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:23.959Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:38:24.014Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:38:24.055Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:38:24.055Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","reconcileID":"9034eb97-88a9-4601-b3bc-0d90cb065d9b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","reconcileID":"9034eb97-88a9-4601-b3bc-0d90cb065d9b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-b69eac","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:38:26.435Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-b69eac","namespace":"openshift-ingress","uid":"c81be07c-2150-4891-980b-8f300f9b121d","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-b69eac\" not found"}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b69eac","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-b69eac\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:38:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:38:26.496Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:38:27.516Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:27.516Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:38:27.577Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-b69eac","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-b69eac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:38:29.027Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-04T00:38:34.653Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:34.660Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:38:34.666Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:34.666Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:38:34.771Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:38:34.772Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:38:35.608Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-58b06e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":13,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4fcb948c-b646-4a79-81f0-c8c8b238ba80\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:02Z"}],"name":"kuadrant-e2e-worker-w2-58b06e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-58b06e","uid":"4fcb948c-b646-4a79-81f0-c8c8b238ba80"}],"resourceVersion":"77206","uid":"732b86e6-fa81-4635-acf0-7deb37d6eb21"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"e146aba91e806fec4ad460501c64f088e7918b3c7df4adc5b88bc6c3faf2ac37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"9dc9d9cec315591800c88f4289e106e101bea3f744c5b9e8db2e7bee888f56d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"63ec76d05da6d8eb8438f4440655f88e11dac33ecc007fa0c01af712b41e570a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"602b24d85c40ef1424ba4360695cdf69f8ff19714c62cbcceab51ed74fdbb3c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"91ef8a3906f365286d0019bcfbefc55ed221a2b34a354423d7e5aabecdfc1e41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fe787d97dad775e52b0925cb3b1fc11a2cccc1c1d01be7803ffa54e7a5c34f04\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7518d66fa47f7f6cabe6c14b9e1911316826c977ac3ad6142125da82716ee49d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dc090a0b1fa64108101227bd0e9b3c7a256183d61df5facdc28601f35312d1b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2a2f0db09cb2fb6f2f7fb7aae81d3230cdc54b055d10cab642b30512426ad32e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"a264fddac0eede3bb186a56c3d99c2c84f52da822bfe449896c63e80d378fa6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"975ea7be7a86f3bd7fd50267137f6de8065399993c7f63b59c191559e47f793b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"0550d6c99a9c75642299947f71e362196d9b4abf2094d7e3ae1dc4c1153628b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"a95a55523a043ed134414c098458e5a7d6983ab83c6259ae31d9d5fa9a8316c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5cf451c78d8f4be30e60bba48086bdc4cf8200cc3ebdbab4eb91c0d2d9e57068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6118193c4ed945f459e205e00e6416c96e49516833c47b89d6ab4cf069c93dd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1d7028f009a317db8afd1e93862135d0f18f2de709aa112b26db637814fd6ef1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"1369d79269306e5fa8bcaf6aa97220019e84961c9b6a9afc7b7b263f0ecb49b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"2480cdb507fa123566b39943d7f0d47eaddf130eba838a9db19503d4f513a022\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"9bc8ba0637406af8bf8245d440db5a33901d9b4f5074b872b15869bdd6287a09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"2124069b6a0d920b738a13569de3259650e6753b0f67ccee6180a5cae31b4c5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6ace09d0808b0cc3ec8485b92185031610ea8a5f271f1d1b8533399d7cd3c81f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c74893123203fae1ad8050e640815fae46cdb7fde29ebfbefa3b6065bc0b820d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5c2c66b930801af0fcd5415e60c1646e4cd4d22f4cab4c51bdb2f5aa9db1a342\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7b596cdf84908424c0234d4546947508d061e01a9490fddfb346ada7a88d98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"567d9ef227a1b0e29d280dbfeb4eacab7843c88000a805f0ef359193c69a8189\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e40f041bd75dbf3b0658d7a49adba76e80113241cee931f90f0c37a1149955ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8713cb237dc57b8e8ced66f8cbc11fc7c18b377af9e36c0138a053141e4df20b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"ce3567b64c376474041ae5a790ea350039c7b065c373d3bc82afe2a18645e225\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"8a3503393c3e9bb4af6707deccbd9de501af9ca64c00bce65971025fe6d62c10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"053fe182975a90257bc91bb8a5ba18938a225856a6ec12e179a0dc901e82026c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6ed13fe5de1ff7dedfc61727996ffa62a24b166093c9d75c2f340d2dd813d7cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dad0c6ed4987ed315608a951935eb320ea90d0b7236754a5f14c216e2672149f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d4fa155ad06444715f5bdd7c86b935b8c3a09c0161684a34c5242e209fd1395e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d255f6849f684d6e9c587b3f81919950ca9931063d04bd20d428877e38cf32bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c831625dbd0f9e3494dc98ae61f4c722e508874473ed5dd3337e4d8b4a5ab8b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"de20c62aecea77c4f5b388cd06473e104621178deb4cf0c778e9e6a0dab0b2b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"0d9d3be3564a3100151a6e1ae1951f13156c7a924c22d306d33ed599169b3a8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"41be2b2d382e17f0d6fb6346c55ba1c2a1df17a426cfc91098af388907da6123\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6318789fe768d7c7c1bf509753a4278019fd033bf3264acfc3fdfb4736e405a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"550b741ebc8392a9c41d86bad794dfa1dac3e217cf38ae211b94ad3b460cf816\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b5a2bfa9c376e074f9d1a5fc1e74b4b8f2be7b2443cee6dc093b54b277b61812\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"d4f9476e079c86438a3e70bf00658c15da54d5affac927aca709f2a5a28a2856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"6d90fbb4b52441d45d1af633f0a5a1c7f4fdaac2beb5a19b805c85ac96e9ced5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b37b3c55782fc38e56fc7c8f891c162219d3ceb3cd7f0a4c2a524ec50e8161da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c5a1feb40731a163ade82e9f405b4d8dd54e59a876cebd6035483ebf43d073ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"5addad89ee48bb5ebc2fff94e068612b169a0543cf684ef8f91e03839a6b46aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"dd4e834b7175a5cf901f9c385d7d10e6783ec3856021a2d78890f5df8fd3d860\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"83d997eaacfd09bfc29a6f839961259fc137d16701d722788b8af24072a60cf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"602faff5ecaf80d48ceedcb6660ff57225a35d1a81dfd16de6c23c17b2c58e1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4fc416c6b94554b03be40292dd34bbe7f23edf74b3de1f2650f9cd17dc8c8dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2559fbf0028a5ba78bd30825f90d521639e7efcff44897276d57ea397c3521d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"00dd40de0fd03d4c4e442d21a39cc29666a793e485c24257ae6f5865d8dcafeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"93acb8e543c3570b87a029840646c64ab84aba25460ef6fde7be10e83afaefef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"fb609aa5491ba907805d2d8a79e6fd486398e0af827f29290c8550c4de9cc08b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"66a3a3221e645480d16e899f2ee66a0f903d082d098085ea6eb7cea5646a9a4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1eb7897d87b8324e162e8c157b519a2453ebc40421c65a5fb6b6cf3a99da37bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"47f2d0dad0904e4754a31b56bc3996015000d246a651cd7ae8a0c11a13c46d29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7e1eb9dec290fe93db72581dd65bd5fd27cc167d1e8123fc32d61e49b3882af0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"16ce1f8437f72a646ef479dfa8d9081aab6a8d15639d9a41302d1dcaeb83d480\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8a9aa2912542895fd0b2c1620fbbff56d6354a0244b869584a9421322d58549a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"3dcd0c3947e33253b1421b74217847eed8f5dad1afe3feda1a3f46868bb89d5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"65ca4d1635580c50567fead06bf8ddc00121f26e3c1b0af3588da26caa4031e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"d08fc10d786223e68c46b2831514aa962b8e810b48bce7c290fd5a9dc946e0c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4652f8a2150a4931901a27c005b2bb44d4d7d1212b652ba25bff4887be9a061d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"afe3e4fd6498dd752c1408d44d697c78067d9cfca49b8e17c957f1107bd29159\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7b5707c55f4a831b6c40c8de714355dc37f0769f3d01e3ab63089a574a5e90c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"c60828ca16ef84b7a5f682d52ef03cede85f017663e62fb9fbc0ad772dfd2ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b80f6cef2e969c1f008570634a903912fbb963e02b61fcd3d6eabc96e4d7e660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"ec22cae50a0d141359a788b23404a1b87020873e849f1c7f2821e4f4f589819f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8011907f4913a9f005064fa089a9485c460a80b7297b4e7706c2794bced53adb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"ea3f4ea4acf30bd44f150de33dd1c53f56bd31e718ea55da79b359501ae332ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"87ebeaa6eb266e52a2aeeffb20a6bfec05537473569fb827a1c21b7f4278a033\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fa7d0d6f93c4fe7b3a94fcb94afd6da2ab83b0ea6d135aa71da22c34993718e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"37cdaebbb9459c785c9575c5ac0f286daad6ed4c5aed53dddcc7bc477a218575\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c37f853416f0a9352736127603b1f84bc1be9730f83da4fc8da4e0aedf2c07e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"aab6da24089d86ef6744750ec37e3ae4ae54a659206c3db678eda83f7331c625\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e7cdfdfbf54424223419f523f1a4eb07195319bff0df2592a923437be7e0ddf9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d42d6ef898b5bb2f53c8be14ffeee02d873488450136c9cde9672f67f8b5db65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0cd68292ce6cf7d2\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c256fd8bd371bcd3200dceaa60a34fd91fbe5b36d1fd2ec991ebc2490e9630a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7511c9e343a4a77a350a8f490a05d514a7fb3a7c49cba5959a484dff97a8d826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"bdd2a7ea22d1e652493a5199df68b6469e1d56e9f4cecd5730da55663f4ae048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"66c1d0d7977e242c1ab5ab2e30c9e5d38016fdb4efbc086cfe61f11b43028d1f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-58b06e"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:38:35.826Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-c893ec","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:33:24Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"0e2c2340-9dbf-4bb8-8c88-ecc3d96cea96\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:36:25Z"}],"name":"kuadrant-e2e-ipp-a-c893ec","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-c893ec","uid":"0e2c2340-9dbf-4bb8-8c88-ecc3d96cea96"}],"resourceVersion":"74860","uid":"ad7e6eab-f5b9-43c7-a69d-6fdb1a196309"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"b7a6f93ef78c8c1ac1abd17a6ac5dd7e99b6268aead4ea506ec30fcf7ada4107\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"ce7f4f69604809bea8aa5751a4c75f06ea03ed01ad44a6ed9918f33d63e3fb47\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"4d9ec91544321e173796b43801474fc919ae8a776faf71359ab40f7a78764952\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"6fc5e1314e8048c56cdfe3a94ecaead4f4496bf601e94f19ab88b122fa8134d7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"d5117346ebc1f238c6696457a805510e2d4a126772b1a3c1118a15e1e507ec80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"2c60abead93bd04ef8e5c83f18fccf5263911dcb9bfb5e11e921c831e98828d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"869d692c92959a0546acab4771e9dfdfbcb06a13cf1365fb929399e6364a4e1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e9e2dad93b3175035841955392d8c73980cbda0fbe9be0aaa170e52b4eb218a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"e1a611f3c199cb462d34967d2e92873382dc73dd343631806ac536bcba9f2ba1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0b0dfcc1da51a4d754ece5d535f25c8dc9773e0e473e6ac8f2d3007494c365c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"e158a308de5eca2ece711d5db4d9ab7ca0bd50b7477fbe66549134108e86b6d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a18ca285b397dc86301cc8f64b98e30717d0cc58b923ddc3f15ff63c331fb287\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"f9322bbae5e61862baaaf67dc0788801e26bd0a340b013dbb0397817a0bb50a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6bcbfe7235a846da224046cbdbb1b97899a7c3b04854c0682ea43d086d6dc94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"5cbf70011375d2fadd7307afb0215dda6b4699a42bfdbd03f2efb47251822393\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7087af63cdd73f2399d08f8e879c80406f9a76f61ee83c0440ce37946aaf0e8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"01b705def7d03dd41c9ffd1c29b09c657e710671e5504bf955f6e96c2be6203c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b1d5dca463c280131e48f71bad53c207c9d3c1b7ab212797adc7927007df46a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"6c8af7e8081800d38d4a68bbd5459170565e1ce42dc129260df4fc4f8ff75be0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3d007c39bd9fddc21cbd655ee4cee5f292b5eeca03e168789bb432ec059fa66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"a8ca4940439007bd739632b536ef8b5be48a3bd56aebe77406723d59e5f1b40e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13a9e6be1e5bc36b79cbf292d44379b6898b96fdfef73c1823239feb634bee3b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"f87bb254d1eb3d0e2f840a63122d9e9a168d9b08f80f8a14e6f46bd8dff20d9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"30c3164627caac6ab0e1f6e5031dbf8128b15abece8e3854ee898dec8121a19b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"feee623051c5cf6a1876940cdd24e036df23a89b189ccef591fd9302b3f37bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"61bc628126cb52be474537dddaf1f5fd75808e137696526d77175a1c046058f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"af1bfc8b273c3ff5e5a810d05f7f47e90d3a2722a041dd2e7524e4d05c40fefc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad2097edbec6e2da243da0e55a5dcc286cc17c67d3beedbe5bc15431d0664778\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"d6cff1724b2ff8c1747241d8e439f9614328f1ae1471ea2ee64233a7eaa4c8c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"674f9e5232871fd840ae70650b877584ff801ff34b3a2e9c8080979050efecc0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"6c352e6389405337c7c8840a0717b8ade0b6c93ca26d400e9f39660458d079c7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"78810bb3547f94a48c904adb9012d1b840e0836a0a03372e8132cd6ea6c2c840\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"3b9788bbab7466fb21e46bcc3479477cc4b439e1fe192b4a80f03e0fbfcc1c39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d98795b31813a250c3a1871d68eeffe7eba40260b30ea72c9163cd3c7eba46f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"37b21b7af45d9db186930208f2e618c8620b38f6fbb31049aa70c374e43da0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"da70a3cec781b9b752831b776c17424a7b73c319969a0eeca9bc3602e58662bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"e51124166e6da7894b262d8c6ff9c1d7252185b5b56b9e42895a52d7bbbc60a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"81f9eb37527d863a772d3b38c32825d183a00c2932e820eeaeda6350de5a0200\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"4098005464fa4c8787f4b89bf483871e8d53628bcd6495c5eee8ddcae4afbd0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0c43a911d4e1832eb2906792a3b002f46374cd914a08828dab41a4a9e2ed949d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5be27b4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-c893ec\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-c893ec\"]}],\"name\":\"cb520c703fe17912cc5a4fd046e96886312bbe5b92cb3c443152779718dd8966\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1601db498b8b8178adbdb4ca9788101365a3d96015c40d2165256c172c46ceea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-c893ec-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b0624403\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57ea7cd82cdc5128\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-c893ec/ipp-route-c893ec-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-c893ec/maas-trlp-ipp-route-c893ec\"]}],\"name\":\"b5f300dda76c4e94a8e9cba88eb0ec1b35c8da31197739902f7b9c265bdf6eee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-c893ec/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-c893ec"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:38:36.553Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:38:36.611Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-c893ec","namespace":"openshift-ingress","uid":"7cb83155-0507-4ed3-91d2-72b564ff3e64","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:38:36.794Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-ipp-route-c893ec","namespace":"ai-tenant-e2e-ipp-a-c893ec","uid":"745788f3-4f70-4471-b885-c660c49ad3fd","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-ipp-route-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:38:37.034Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-b69eac","namespace":"openshift-ingress","uid":"c81be07c-2150-4891-980b-8f300f9b121d","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-b69eac\" not found"}
{"level":"error","ts":"2026-11-04T00:38:37.771Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:38:38.198Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-b69eac","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-b69eac\" not found"}
{"level":"error","ts":"2026-11-04T00:38:38.601Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"ipp-route-c893ec-kserve-route","namespace":"ai-tenant-e2e-ipp-a-c893ec","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"ipp-route-c893ec-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:38:46.619Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","HTTPRoute","ConfigMap","EnvoyFilter","Kuadrant","AuthPolicy","Gateway"],"eventTypes":{"delete":7,"update":11}}
{"level":"info","ts":"2026-11-04T00:38:46.967Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:46.976Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:50.027Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:38:50.349Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:38:50.548Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:38:50.548Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:38:50.548Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:38:53.836Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:38:53.845Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:53.845Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:38:53.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:53.854Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:38:53.863Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:38:54.037Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:38:56.063Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-697182-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-697182-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:38:56.775Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:38:57.144Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:38:57.144Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b20934","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b20934","reconcileID":"bc4d0c43-db31-46b3-b3cd-ad29d3b0c38e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-b20934","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b20934","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b20934","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b20934","reconcileID":"bc4d0c43-db31-46b3-b3cd-ad29d3b0c38e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-b20934","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-b20934","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b20934","reconcileID":"16862692-611a-46a9-92df-71b9014cb48b","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-b20934\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-b20934","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-b20934\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:39:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:39:09.027Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Limitador","EnvoyFilter","ConfigMap","AuthConfig"],"eventTypes":{"delete":6,"update":6}}
{"level":"info","ts":"2026-11-04T00:39:09.376Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:11.362Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:39:11.515Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:39:11.515Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:39:14.738Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:39:14.745Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:14.749Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:39:14.750Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:14.750Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:39:14.757Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:39:14.836Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-a-b20934","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-b20934\" not found"}
{"level":"error","ts":"2026-11-04T00:39:15.013Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-a-b20934","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-b20934\" not found"}
{"level":"error","ts":"2026-11-04T00:39:15.013Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:39:15.013Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:39:15.789Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-b20934","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-a-b20934","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-b20934\" not found"}
{"level":"error","ts":"2026-11-04T00:39:17.183Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-b20934-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-a-b20934-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T00:39:18.290Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:18.290Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:39:19.033Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-b20934","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-b20934\" not found"}
{"level":"info","ts":"2026-11-04T00:39:19.783Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","Kuadrant","HTTPRoute"],"eventTypes":{"delete":2,"update":3}}
{"level":"info","ts":"2026-11-04T00:39:19.975Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:19.982Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:23.228Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:39:23.260Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:39:23.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:39:23.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:39:23.354Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:39:26.669Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:39:26.669Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:26.719Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:39:26.720Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:39:26.722Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:26.722Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:39:26.835Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-a-b20934","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-b20934\" not found"}
{"level":"error","ts":"2026-11-04T00:39:26.836Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-a-b20934","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-b20934\" not found"}
{"level":"error","ts":"2026-11-04T00:39:26.836Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-6"},"creationTimestamp":"2026-11-04T00:34:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:34:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:34:06Z"}],"name":"0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989","namespace":"kuadrant-system","resourceVersion":"71173","uid":"c7222041-463e-486a-8e13-9a196667a80a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:26.843Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:39:26.843Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:39:26.917Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:38:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:03Z"}],"name":"de6b376cdc353e536e687400afde64f53961d19e663d39be688a0737a2b2680e","namespace":"kuadrant-system","resourceVersion":"77220","uid":"c8d943b7-90ec-42a4-897e-e6a2b53f6d51"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de6b376cdc353e536e687400afde64f53961d19e663d39be688a0737a2b2680e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de6b376cdc353e536e687400afde64f53961d19e663d39be688a0737a2b2680e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de6b376cdc353e536e687400afde64f53961d19e663d39be688a0737a2b2680e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:26.983Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-3"},"creationTimestamp":"2026-11-04T00:34:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:34:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:34:06Z"}],"name":"a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8","namespace":"kuadrant-system","resourceVersion":"71184","uid":"df16c070-1d90-457e-8bb4-941f35538583"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.080Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-1"},"creationTimestamp":"2026-11-04T00:34:05Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:34:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:34:06Z"}],"name":"5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a","namespace":"kuadrant-system","resourceVersion":"71177","uid":"02f87b13-9068-42fd-98f6-6e99a2354cfc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.145Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:38:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:02Z"}],"name":"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443","namespace":"kuadrant-system","resourceVersion":"77192","uid":"c7ce7831-867e-4956-9955-fcea4e008f3e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.211Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-2"},"creationTimestamp":"2026-11-04T00:34:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:34:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:34:06Z"}],"name":"920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338","namespace":"kuadrant-system","resourceVersion":"71185","uid":"dec3966f-0266-4f44-9466-ebfe60564e38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.289Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:38:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:02Z"}],"name":"b26ce7ea2624e68545c0350ffa608ca4d5c967ac75f46f6f9faeb8f7ea009a95","namespace":"kuadrant-system","resourceVersion":"77211","uid":"86ce5782-bda2-4e78-bb50-3f4369871ca7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b26ce7ea2624e68545c0350ffa608ca4d5c967ac75f46f6f9faeb8f7ea009a95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b26ce7ea2624e68545c0350ffa608ca4d5c967ac75f46f6f9faeb8f7ea009a95"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b26ce7ea2624e68545c0350ffa608ca4d5c967ac75f46f6f9faeb8f7ea009a95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.356Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:38:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:02Z"}],"name":"b3d975a4971c2a9ae72f2a8ef8333eb45d4713d6277b59c26ef80d6bb2be42a9","namespace":"kuadrant-system","resourceVersion":"77188","uid":"c49f03ff-a7b0-46bc-8322-ef0e95ab8d5a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b3d975a4971c2a9ae72f2a8ef8333eb45d4713d6277b59c26ef80d6bb2be42a9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b3d975a4971c2a9ae72f2a8ef8333eb45d4713d6277b59c26ef80d6bb2be42a9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b3d975a4971c2a9ae72f2a8ef8333eb45d4713d6277b59c26ef80d6bb2be42a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.422Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:38:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:02Z"}],"name":"75f54bc5353c4d3063f1466e62a6e65e82a52c69fb2970273309c4b07570e244","namespace":"kuadrant-system","resourceVersion":"77198","uid":"62f686da-fb5e-4a89-812b-9417cf850e3b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75f54bc5353c4d3063f1466e62a6e65e82a52c69fb2970273309c4b07570e244"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75f54bc5353c4d3063f1466e62a6e65e82a52c69fb2970273309c4b07570e244"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75f54bc5353c4d3063f1466e62a6e65e82a52c69fb2970273309c4b07570e244\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.490Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:38:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:02Z"}],"name":"ab0362982f33cf77e74bafb2ddf9b7b023e89e5427ad977283f4c41524814757","namespace":"kuadrant-system","resourceVersion":"77208","uid":"567f4fc8-38f9-41cb-a113-d30283592947"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab0362982f33cf77e74bafb2ddf9b7b023e89e5427ad977283f4c41524814757"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab0362982f33cf77e74bafb2ddf9b7b023e89e5427ad977283f4c41524814757"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab0362982f33cf77e74bafb2ddf9b7b023e89e5427ad977283f4c41524814757\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.556Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-5"},"creationTimestamp":"2026-11-04T00:34:05Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:34:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:34:06Z"}],"name":"8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4","namespace":"kuadrant-system","resourceVersion":"71169","uid":"075859da-462e-4bec-99c8-fdde28ead235"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.621Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:38:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:03Z"}],"name":"57a651d432e82fcb452972cb89bc08d73dfd5300a2be005e0d3c1b5abb3bc08c","namespace":"kuadrant-system","resourceVersion":"77224","uid":"21120309-e718-4a71-a1aa-c0193240eca2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["57a651d432e82fcb452972cb89bc08d73dfd5300a2be005e0d3c1b5abb3bc08c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["57a651d432e82fcb452972cb89bc08d73dfd5300a2be005e0d3c1b5abb3bc08c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"57a651d432e82fcb452972cb89bc08d73dfd5300a2be005e0d3c1b5abb3bc08c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.687Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:38:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:02Z"}],"name":"6f1c8865631e08e6865222cf7c67b4f1e4fd3ef2e73aeedfeaafb0c62e922b30","namespace":"kuadrant-system","resourceVersion":"77184","uid":"3942983a-4435-4e7f-933d-1de549928985"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6f1c8865631e08e6865222cf7c67b4f1e4fd3ef2e73aeedfeaafb0c62e922b30"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6f1c8865631e08e6865222cf7c67b4f1e4fd3ef2e73aeedfeaafb0c62e922b30"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6f1c8865631e08e6865222cf7c67b4f1e4fd3ef2e73aeedfeaafb0c62e922b30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.764Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:38:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:03Z"}],"name":"4f933df876ef27cca7c9f4a691245ca2066499cf89096da05f770a45bc8aee35","namespace":"kuadrant-system","resourceVersion":"77214","uid":"4968d0cb-0917-4e0d-b373-80901205a868"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f933df876ef27cca7c9f4a691245ca2066499cf89096da05f770a45bc8aee35"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f933df876ef27cca7c9f4a691245ca2066499cf89096da05f770a45bc8aee35"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f933df876ef27cca7c9f4a691245ca2066499cf89096da05f770a45bc8aee35\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.834Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-4"},"creationTimestamp":"2026-11-04T00:34:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:34:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:34:06Z"}],"name":"554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b","namespace":"kuadrant-system","resourceVersion":"71181","uid":"e79f2d3e-6969-489f-91e4-cb8efb5b8a89"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.915Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:38:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:03Z"}],"name":"1798d55057b6d0cca6f9abd70585585f923cf50541f4ea327da38c6cbbb73344","namespace":"kuadrant-system","resourceVersion":"77222","uid":"877ce4b1-044f-4fb2-be27-b78012bdaaf6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1798d55057b6d0cca6f9abd70585585f923cf50541f4ea327da38c6cbbb73344"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1798d55057b6d0cca6f9abd70585585f923cf50541f4ea327da38c6cbbb73344"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1798d55057b6d0cca6f9abd70585585f923cf50541f4ea327da38c6cbbb73344\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:27.981Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:38:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:03Z"}],"name":"bb97d028680959de1290dbad1bdf5bfd2fd46c3dfd3f71a36e19ee29845fc15c","namespace":"kuadrant-system","resourceVersion":"77225","uid":"4fbc67e8-bf6e-42df-807d-51ecde95e575"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bb97d028680959de1290dbad1bdf5bfd2fd46c3dfd3f71a36e19ee29845fc15c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bb97d028680959de1290dbad1bdf5bfd2fd46c3dfd3f71a36e19ee29845fc15c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bb97d028680959de1290dbad1bdf5bfd2fd46c3dfd3f71a36e19ee29845fc15c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:28.048Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:38:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:38:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:02Z"}],"name":"43306fa4e8b92dcb3c9720febb98eeb170e90451da6e6bfc50d8a2bb9aa464ae","namespace":"kuadrant-system","resourceVersion":"77201","uid":"37c6a047-25f1-4c35-9085-e31bd78e59c9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["43306fa4e8b92dcb3c9720febb98eeb170e90451da6e6bfc50d8a2bb9aa464ae"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:38:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["43306fa4e8b92dcb3c9720febb98eeb170e90451da6e6bfc50d8a2bb9aa464ae"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"43306fa4e8b92dcb3c9720febb98eeb170e90451da6e6bfc50d8a2bb9aa464ae\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:28.106Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/27dd5c806343f9c1bc5f9021b2232f2b65f17c1206dc1bfd49c6faef4198722d","error":"authconfigs.authorino.kuadrant.io \"27dd5c806343f9c1bc5f9021b2232f2b65f17c1206dc1bfd49c6faef4198722d\" not found"}
{"level":"error","ts":"2026-11-04T00:39:28.160Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1a6883fee27b462102f5dc74a8681c6a941d89b41c7caa7a8c2fdf79f456fc2a","error":"authconfigs.authorino.kuadrant.io \"1a6883fee27b462102f5dc74a8681c6a941d89b41c7caa7a8c2fdf79f456fc2a\" not found"}
{"level":"error","ts":"2026-11-04T00:39:28.215Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ab742ddaa7885ef7f93d2397f3ccadaf7bf2188621cf8bb61c2733b928835dba","error":"authconfigs.authorino.kuadrant.io \"ab742ddaa7885ef7f93d2397f3ccadaf7bf2188621cf8bb61c2733b928835dba\" not found"}
{"level":"error","ts":"2026-11-04T00:39:28.241Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-b20934","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-a-b20934","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-b20934\" not found"}
{"level":"error","ts":"2026-11-04T00:39:28.269Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9992f96124a8d0167e941d9e2d3dd0ffd408fef7f73f1221be6adcefdbdc4a23","error":"authconfigs.authorino.kuadrant.io \"9992f96124a8d0167e941d9e2d3dd0ffd408fef7f73f1221be6adcefdbdc4a23\" not found"}
{"level":"error","ts":"2026-11-04T00:39:28.324Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3bf9dcc59a2bf8e8b8897d1a9eda8f0be85a6b08981ebc66c637f6a69feb059b","error":"authconfigs.authorino.kuadrant.io \"3bf9dcc59a2bf8e8b8897d1a9eda8f0be85a6b08981ebc66c637f6a69feb059b\" not found"}
{"level":"error","ts":"2026-11-04T00:39:28.379Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/913876879bf8f08fb41ca8870dbdaea73ead7036db906905a431fc15d8a47e6c","error":"authconfigs.authorino.kuadrant.io \"913876879bf8f08fb41ca8870dbdaea73ead7036db906905a431fc15d8a47e6c\" not found"}
{"level":"error","ts":"2026-11-04T00:39:28.923Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-ipp-route-c893ec","namespace":"ai-tenant-e2e-ipp-a-c893ec","uid":"745788f3-4f70-4471-b885-c660c49ad3fd","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-ipp-route-c893ec\" not found"}
{"level":"error","ts":"2026-11-04T00:39:28.930Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-697182-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-697182-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:29.076Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-c893ec-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-c893ec-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:29.169Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:29.286Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-b20934-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-a-b20934-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T00:39:29.901Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:29.901Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:39:30.565Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-c893ec","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-c893ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:39:30.751Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-b20934","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-b20934\" not found"}
{"level":"info","ts":"2026-11-04T00:39:38.131Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","Gateway","AuthPolicy","ConfigMap","Limitador","EnvoyFilter","HTTPRoute"],"eventTypes":{"delete":13,"update":24}}
{"level":"info","ts":"2026-11-04T00:39:38.524Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:40.446Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:39:40.661Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:39:40.661Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:39:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-93a388","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-93a388","reconcileID":"f8961b93-c091-42ea-91b9-d5eeacab69d1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-93a388","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:39:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-93a388","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:39:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:39:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:39:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:39:42Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:39:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-93a388","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-93a388","reconcileID":"f8961b93-c091-42ea-91b9-d5eeacab69d1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-93a388","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:39:43Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-93a388","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-93a388","reconcileID":"7fbb809d-b66f-40c0-b32f-b559854df42f","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-93a388\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:39:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-93a388","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:39:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:39:43Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-93a388\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:39:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:39:44.054Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:39:44.060Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:44.062Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:44.062Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:39:44.067Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:39:44.071Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:39:44.292Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:39:46.628Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-93a388","namespace":"openshift-ingress","uid":"f991d5e9-ae69-4664-bb43-899582bbc2ea","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-93a388\" not found"}
{"level":"error","ts":"2026-11-04T00:39:47.053Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:39:47.175Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:47.175Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:39:48.074Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-93a388","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-93a388\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","reconcileID":"06b95216-33a9-42c6-90a5-5cf3795de409","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","reconcileID":"06b95216-33a9-42c6-90a5-5cf3795de409","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-c893ec","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-c893ec","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-c893ec\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:39:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:39:58.523Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","TokenRateLimitPolicy","AuthPolicy","Gateway","Limitador","ConfigMap","Kuadrant","HTTPRoute"],"eventTypes":{"create":1,"delete":15,"update":17}}
{"level":"info","ts":"2026-11-04T00:39:58.826Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:39:58.847Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:01.361Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:01.449Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:40:01.528Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:40:01.638Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:40:01.638Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:03Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","reconcileID":"080bcc36-73ff-4923-900e-a084d2e7c014","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","reconcileID":"080bcc36-73ff-4923-900e-a084d2e7c014","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-e62743","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-e62743","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-e62743\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:40:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:40:04.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:04.863Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:40:04.866Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:04.866Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:04.873Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:40:04.854Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:40:04.933Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-a-c893ec","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-c893ec\" not found"}
{"level":"error","ts":"2026-11-04T00:40:04.933Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-a-c893ec","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-c893ec\" not found"}
{"level":"error","ts":"2026-11-04T00:40:04.969Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:40:04.969Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:40:05.360Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-c893ec","envoyfilter":"openshift-ingress/kuadrant-e2e-ipp-a-c893ec","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-c893ec\" not found"}
{"level":"error","ts":"2026-11-04T00:40:06.417Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-c893ec-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-a-c893ec-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:40:06.607Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:06.851Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-e62743","namespace":"openshift-ingress","uid":"c69b1285-7bae-4c46-8587-a7710d73a1d1","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-e62743\" not found"}
{"level":"info","ts":"2026-11-04T00:40:07.805Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:07.805Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:40:08.070Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-c893ec","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-a-c893ec\" not found"}
{"level":"error","ts":"2026-11-04T00:40:08.597Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-e62743","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-e62743\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:40:09.062Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","EnvoyFilter","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":6,"update":2}}
{"level":"info","ts":"2026-11-04T00:40:09.151Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:09.155Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:12.514Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:40:12.635Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:13.164Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:40:13.328Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:40:13.328Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:16.720Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:40:16.730Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:16.730Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:16.741Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:16.742Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:40:16.748Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:40:16.813Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-a-c893ec","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-c893ec\" not found"}
{"level":"error","ts":"2026-11-04T00:40:16.829Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-a-c893ec","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-c893ec\" not found"}
{"level":"error","ts":"2026-11-04T00:40:16.833Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:40:16.833Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:40:16.867Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d81311de9c1c515eddfa6cd7fa66b172b76028c6a6131122bf6a62a8f045078","error":"authconfigs.authorino.kuadrant.io \"7d81311de9c1c515eddfa6cd7fa66b172b76028c6a6131122bf6a62a8f045078\" not found"}
{"level":"error","ts":"2026-11-04T00:40:16.922Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0c43a911d4e1832eb2906792a3b002f46374cd914a08828dab41a4a9e2ed949d","error":"authconfigs.authorino.kuadrant.io \"0c43a911d4e1832eb2906792a3b002f46374cd914a08828dab41a4a9e2ed949d\" not found"}
{"level":"error","ts":"2026-11-04T00:40:16.976Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b0b0dfcc1da51a4d754ece5d535f25c8dc9773e0e473e6ac8f2d3007494c365c","error":"authconfigs.authorino.kuadrant.io \"b0b0dfcc1da51a4d754ece5d535f25c8dc9773e0e473e6ac8f2d3007494c365c\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.030Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2d98795b31813a250c3a1871d68eeffe7eba40260b30ea72c9163cd3c7eba46f","error":"authconfigs.authorino.kuadrant.io \"2d98795b31813a250c3a1871d68eeffe7eba40260b30ea72c9163cd3c7eba46f\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.085Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/85fd95b16011eb6ea7c7f832971e8706baddf9c21798e1b9d385af4bc78f7f65","error":"authconfigs.authorino.kuadrant.io \"85fd95b16011eb6ea7c7f832971e8706baddf9c21798e1b9d385af4bc78f7f65\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.127Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-c893ec","envoyfilter":"openshift-ingress/kuadrant-e2e-ipp-a-c893ec","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-c893ec\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.140Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/03f56b48d109c78e7b823b9c08f07a0d3f08cb8159bfcb809416d5a788cf0117","error":"authconfigs.authorino.kuadrant.io \"03f56b48d109c78e7b823b9c08f07a0d3f08cb8159bfcb809416d5a788cf0117\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.194Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/78810bb3547f94a48c904adb9012d1b840e0836a0a03372e8132cd6ea6c2c840","error":"authconfigs.authorino.kuadrant.io \"78810bb3547f94a48c904adb9012d1b840e0836a0a03372e8132cd6ea6c2c840\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.248Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/79948b9f150fd820df62b6b0be09103f62dde34407537d222dbee0b7d0f297e7","error":"authconfigs.authorino.kuadrant.io \"79948b9f150fd820df62b6b0be09103f62dde34407537d222dbee0b7d0f297e7\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.303Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/da70a3cec781b9b752831b776c17424a7b73c319969a0eeca9bc3602e58662bf","error":"authconfigs.authorino.kuadrant.io \"da70a3cec781b9b752831b776c17424a7b73c319969a0eeca9bc3602e58662bf\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.357Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dd6a464aa19dc14981275b6d76cb8573e9b5549f5c5a2f6613a64154c94ad32b","error":"authconfigs.authorino.kuadrant.io \"dd6a464aa19dc14981275b6d76cb8573e9b5549f5c5a2f6613a64154c94ad32b\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.414Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2c1883b95059b6beae9d79f8222d241684b419169bbe6efc67f25b545ea00e5f","error":"authconfigs.authorino.kuadrant.io \"2c1883b95059b6beae9d79f8222d241684b419169bbe6efc67f25b545ea00e5f\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/81f9eb37527d863a772d3b38c32825d183a00c2932e820eeaeda6350de5a0200","error":"authconfigs.authorino.kuadrant.io \"81f9eb37527d863a772d3b38c32825d183a00c2932e820eeaeda6350de5a0200\" not found"}
{"level":"error","ts":"2026-11-04T00:40:17.608Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-58b06e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":16,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4fcb948c-b646-4a79-81f0-c8c8b238ba80\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:39:44Z"}],"name":"kuadrant-e2e-worker-w2-58b06e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-58b06e","uid":"4fcb948c-b646-4a79-81f0-c8c8b238ba80"}],"resourceVersion":"79714","uid":"732b86e6-fa81-4635-acf0-7deb37d6eb21"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"e146aba91e806fec4ad460501c64f088e7918b3c7df4adc5b88bc6c3faf2ac37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"9dc9d9cec315591800c88f4289e106e101bea3f744c5b9e8db2e7bee888f56d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"63ec76d05da6d8eb8438f4440655f88e11dac33ecc007fa0c01af712b41e570a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"602b24d85c40ef1424ba4360695cdf69f8ff19714c62cbcceab51ed74fdbb3c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"91ef8a3906f365286d0019bcfbefc55ed221a2b34a354423d7e5aabecdfc1e41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fe787d97dad775e52b0925cb3b1fc11a2cccc1c1d01be7803ffa54e7a5c34f04\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"7518d66fa47f7f6cabe6c14b9e1911316826c977ac3ad6142125da82716ee49d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dc090a0b1fa64108101227bd0e9b3c7a256183d61df5facdc28601f35312d1b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2a2f0db09cb2fb6f2f7fb7aae81d3230cdc54b055d10cab642b30512426ad32e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"a264fddac0eede3bb186a56c3d99c2c84f52da822bfe449896c63e80d378fa6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"975ea7be7a86f3bd7fd50267137f6de8065399993c7f63b59c191559e47f793b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"0550d6c99a9c75642299947f71e362196d9b4abf2094d7e3ae1dc4c1153628b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"a95a55523a043ed134414c098458e5a7d6983ab83c6259ae31d9d5fa9a8316c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5cf451c78d8f4be30e60bba48086bdc4cf8200cc3ebdbab4eb91c0d2d9e57068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"6118193c4ed945f459e205e00e6416c96e49516833c47b89d6ab4cf069c93dd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1d7028f009a317db8afd1e93862135d0f18f2de709aa112b26db637814fd6ef1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"1369d79269306e5fa8bcaf6aa97220019e84961c9b6a9afc7b7b263f0ecb49b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"2480cdb507fa123566b39943d7f0d47eaddf130eba838a9db19503d4f513a022\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"9bc8ba0637406af8bf8245d440db5a33901d9b4f5074b872b15869bdd6287a09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"2124069b6a0d920b738a13569de3259650e6753b0f67ccee6180a5cae31b4c5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6ace09d0808b0cc3ec8485b92185031610ea8a5f271f1d1b8533399d7cd3c81f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c74893123203fae1ad8050e640815fae46cdb7fde29ebfbefa3b6065bc0b820d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5c2c66b930801af0fcd5415e60c1646e4cd4d22f4cab4c51bdb2f5aa9db1a342\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7b596cdf84908424c0234d4546947508d061e01a9490fddfb346ada7a88d98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"567d9ef227a1b0e29d280dbfeb4eacab7843c88000a805f0ef359193c69a8189\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"e40f041bd75dbf3b0658d7a49adba76e80113241cee931f90f0c37a1149955ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8713cb237dc57b8e8ced66f8cbc11fc7c18b377af9e36c0138a053141e4df20b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"ce3567b64c376474041ae5a790ea350039c7b065c373d3bc82afe2a18645e225\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"8a3503393c3e9bb4af6707deccbd9de501af9ca64c00bce65971025fe6d62c10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"053fe182975a90257bc91bb8a5ba18938a225856a6ec12e179a0dc901e82026c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"6ed13fe5de1ff7dedfc61727996ffa62a24b166093c9d75c2f340d2dd813d7cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dad0c6ed4987ed315608a951935eb320ea90d0b7236754a5f14c216e2672149f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d4fa155ad06444715f5bdd7c86b935b8c3a09c0161684a34c5242e209fd1395e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d255f6849f684d6e9c587b3f81919950ca9931063d04bd20d428877e38cf32bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c831625dbd0f9e3494dc98ae61f4c722e508874473ed5dd3337e4d8b4a5ab8b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"de20c62aecea77c4f5b388cd06473e104621178deb4cf0c778e9e6a0dab0b2b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"0d9d3be3564a3100151a6e1ae1951f13156c7a924c22d306d33ed599169b3a8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"41be2b2d382e17f0d6fb6346c55ba1c2a1df17a426cfc91098af388907da6123\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6318789fe768d7c7c1bf509753a4278019fd033bf3264acfc3fdfb4736e405a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"550b741ebc8392a9c41d86bad794dfa1dac3e217cf38ae211b94ad3b460cf816\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b5a2bfa9c376e074f9d1a5fc1e74b4b8f2be7b2443cee6dc093b54b277b61812\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"d4f9476e079c86438a3e70bf00658c15da54d5affac927aca709f2a5a28a2856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"6d90fbb4b52441d45d1af633f0a5a1c7f4fdaac2beb5a19b805c85ac96e9ced5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b37b3c55782fc38e56fc7c8f891c162219d3ceb3cd7f0a4c2a524ec50e8161da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c5a1feb40731a163ade82e9f405b4d8dd54e59a876cebd6035483ebf43d073ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"5addad89ee48bb5ebc2fff94e068612b169a0543cf684ef8f91e03839a6b46aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"dd4e834b7175a5cf901f9c385d7d10e6783ec3856021a2d78890f5df8fd3d860\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"83d997eaacfd09bfc29a6f839961259fc137d16701d722788b8af24072a60cf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"602faff5ecaf80d48ceedcb6660ff57225a35d1a81dfd16de6c23c17b2c58e1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4fc416c6b94554b03be40292dd34bbe7f23edf74b3de1f2650f9cd17dc8c8dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2559fbf0028a5ba78bd30825f90d521639e7efcff44897276d57ea397c3521d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"00dd40de0fd03d4c4e442d21a39cc29666a793e485c24257ae6f5865d8dcafeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"93acb8e543c3570b87a029840646c64ab84aba25460ef6fde7be10e83afaefef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"fb609aa5491ba907805d2d8a79e6fd486398e0af827f29290c8550c4de9cc08b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"66a3a3221e645480d16e899f2ee66a0f903d082d098085ea6eb7cea5646a9a4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"1eb7897d87b8324e162e8c157b519a2453ebc40421c65a5fb6b6cf3a99da37bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"47f2d0dad0904e4754a31b56bc3996015000d246a651cd7ae8a0c11a13c46d29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7e1eb9dec290fe93db72581dd65bd5fd27cc167d1e8123fc32d61e49b3882af0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"16ce1f8437f72a646ef479dfa8d9081aab6a8d15639d9a41302d1dcaeb83d480\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"8a9aa2912542895fd0b2c1620fbbff56d6354a0244b869584a9421322d58549a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"3dcd0c3947e33253b1421b74217847eed8f5dad1afe3feda1a3f46868bb89d5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"65ca4d1635580c50567fead06bf8ddc00121f26e3c1b0af3588da26caa4031e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"d08fc10d786223e68c46b2831514aa962b8e810b48bce7c290fd5a9dc946e0c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4652f8a2150a4931901a27c005b2bb44d4d7d1212b652ba25bff4887be9a061d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"afe3e4fd6498dd752c1408d44d697c78067d9cfca49b8e17c957f1107bd29159\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"7b5707c55f4a831b6c40c8de714355dc37f0769f3d01e3ab63089a574a5e90c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"c60828ca16ef84b7a5f682d52ef03cede85f017663e62fb9fbc0ad772dfd2ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"b80f6cef2e969c1f008570634a903912fbb963e02b61fcd3d6eabc96e4d7e660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"ec22cae50a0d141359a788b23404a1b87020873e849f1c7f2821e4f4f589819f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8011907f4913a9f005064fa089a9485c460a80b7297b4e7706c2794bced53adb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"ea3f4ea4acf30bd44f150de33dd1c53f56bd31e718ea55da79b359501ae332ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"87ebeaa6eb266e52a2aeeffb20a6bfec05537473569fb827a1c21b7f4278a033\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fa7d0d6f93c4fe7b3a94fcb94afd6da2ab83b0ea6d135aa71da22c34993718e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"37cdaebbb9459c785c9575c5ac0f286daad6ed4c5aed53dddcc7bc477a218575\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c37f853416f0a9352736127603b1f84bc1be9730f83da4fc8da4e0aedf2c07e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"aab6da24089d86ef6744750ec37e3ae4ae54a659206c3db678eda83f7331c625\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e7cdfdfbf54424223419f523f1a4eb07195319bff0df2592a923437be7e0ddf9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d42d6ef898b5bb2f53c8be14ffeee02d873488450136c9cde9672f67f8b5db65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c256fd8bd371bcd3200dceaa60a34fd91fbe5b36d1fd2ec991ebc2490e9630a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7511c9e343a4a77a350a8f490a05d514a7fb3a7c49cba5959a484dff97a8d826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__b38c22ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9ab13b891a797a2d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"bdd2a7ea22d1e652493a5199df68b6469e1d56e9f4cecd5730da55663f4ae048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"66c1d0d7977e242c1ab5ab2e30c9e5d38016fdb4efbc086cfe61f11b43028d1f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-58b06e"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:18.135Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-e62743","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:37:25Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"e54a526d-9c67-4770-8c57-563d2f159259\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:37:25Z"}],"name":"kuadrant-e2e-praxis-b-e62743","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-e62743","uid":"e54a526d-9c67-4770-8c57-563d2f159259"}],"resourceVersion":"76239","uid":"906686d4-70d1-4a99-9aba-1dbd2706299c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bbd206ecb04eba810c7c5e52475c7debac0f4639fd2fc558005b46453da3b355\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-e62743-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]}],\"name\":\"1c33b0d8fba05422049e8c94a44fb2e987ee8301e39c70be3c78faaf30c2a1ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6a10549d6254c55dd74c4b8bb85baee3fd0c65cf8a49aefa26d7b71c72f70c48\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-e62743-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]}],\"name\":\"e0b21f0f5d73300f14f20f4c5426688695c6961af3d38c33768ed5961c4b4127\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6a1f4e57e9bc410fe4752ad063e020630ef15a63b484bbd6fd3dad2e244ff3c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-e62743-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]}],\"name\":\"716dc1540b376303c2b11f9d4159ff9b77993c56bf22c80216d246b7a65d6caf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c95d12e21bdcb32c4b35570bf0ff60205303d82c59fd1d6dc2138fb034d9616\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-e62743-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]}],\"name\":\"00c6a4d7a5df8db768852f610f49022b8fdfac5cd071fd3500ea07d82cf8b23b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f0e0d0259602f24a8cd17bf7e3d60fed46a6e99a0d0ce1bff4559ff1ff33c53a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-e62743-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]}],\"name\":\"1267d934956a509e9f20ff0659361ad234bb1e6b835d9ccec05bed660b6f0978\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1319eacbd187bc7b4b81fdeb96b308e7baf828249dea8a6c62f12f66ad850c33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-e62743-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__92f5b6e5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-e62743\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-e62743\"]}],\"name\":\"2c723a237fd815c06d959dc2db7e33218893ecadba079a9b5575e30eb4637310\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-e62743"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-e62743\" not found"}
{"level":"error","ts":"2026-11-04T00:40:18.551Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-e62743","namespace":"openshift-ingress","uid":"c69b1285-7bae-4c46-8587-a7710d73a1d1","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-e62743\" not found"}
{"level":"error","ts":"2026-11-04T00:40:18.570Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-e62743-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-b-e62743-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:40:18.918Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:18.939Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-c893ec-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-a-c893ec-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:40:19.037Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-temp-model-status","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"f6ebcbb5-d548-4225-86f4-7f0462ac9c71","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-temp-model-status\" not found"}
{"level":"error","ts":"2026-11-04T00:40:19.216Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:40:19.648Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:19.648Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:40:19.762Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-58b06e-kserve-route","namespace":"e2e-models-e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w2-58b06e-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:19.838Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-e62743","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-b-e62743\" not found"}
{"level":"error","ts":"2026-11-04T00:40:20.014Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-c893ec","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-a-c893ec\" not found"}
{"level":"info","ts":"2026-11-04T00:40:27.641Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","EnvoyFilter","HTTPRoute","TokenRateLimitPolicy","Kuadrant","Gateway","AuthConfig","AuthPolicy"],"eventTypes":{"create":1,"delete":25,"update":8}}
{"level":"info","ts":"2026-11-04T00:40:27.990Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:27.999Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:30.813Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:40:30.952Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:40:31.128Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:40:31.128Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:31.359Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:34.332Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:40:34.346Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:34.352Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:40:34.358Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:34.358Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:34.413Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:40:34.476Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:40:36.130Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:36.566Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:37.164Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:40:37.230Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:37.233Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:38.391Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T00:40:42.763Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:42.767Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:42.767Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:42.769Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:40:42.828Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:40:42.828Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:40:43.419Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-58b06e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":17,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4fcb948c-b646-4a79-81f0-c8c8b238ba80\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:40:06Z"}],"name":"kuadrant-e2e-worker-w2-58b06e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-58b06e","uid":"4fcb948c-b646-4a79-81f0-c8c8b238ba80"}],"resourceVersion":"80267","uid":"732b86e6-fa81-4635-acf0-7deb37d6eb21"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"e146aba91e806fec4ad460501c64f088e7918b3c7df4adc5b88bc6c3faf2ac37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"9dc9d9cec315591800c88f4289e106e101bea3f744c5b9e8db2e7bee888f56d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"63ec76d05da6d8eb8438f4440655f88e11dac33ecc007fa0c01af712b41e570a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"602b24d85c40ef1424ba4360695cdf69f8ff19714c62cbcceab51ed74fdbb3c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"91ef8a3906f365286d0019bcfbefc55ed221a2b34a354423d7e5aabecdfc1e41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fe787d97dad775e52b0925cb3b1fc11a2cccc1c1d01be7803ffa54e7a5c34f04\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7518d66fa47f7f6cabe6c14b9e1911316826c977ac3ad6142125da82716ee49d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dc090a0b1fa64108101227bd0e9b3c7a256183d61df5facdc28601f35312d1b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2a2f0db09cb2fb6f2f7fb7aae81d3230cdc54b055d10cab642b30512426ad32e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"a264fddac0eede3bb186a56c3d99c2c84f52da822bfe449896c63e80d378fa6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"975ea7be7a86f3bd7fd50267137f6de8065399993c7f63b59c191559e47f793b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"0550d6c99a9c75642299947f71e362196d9b4abf2094d7e3ae1dc4c1153628b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"a95a55523a043ed134414c098458e5a7d6983ab83c6259ae31d9d5fa9a8316c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5cf451c78d8f4be30e60bba48086bdc4cf8200cc3ebdbab4eb91c0d2d9e57068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6118193c4ed945f459e205e00e6416c96e49516833c47b89d6ab4cf069c93dd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1d7028f009a317db8afd1e93862135d0f18f2de709aa112b26db637814fd6ef1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"1369d79269306e5fa8bcaf6aa97220019e84961c9b6a9afc7b7b263f0ecb49b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"2480cdb507fa123566b39943d7f0d47eaddf130eba838a9db19503d4f513a022\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"9bc8ba0637406af8bf8245d440db5a33901d9b4f5074b872b15869bdd6287a09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"2124069b6a0d920b738a13569de3259650e6753b0f67ccee6180a5cae31b4c5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6ace09d0808b0cc3ec8485b92185031610ea8a5f271f1d1b8533399d7cd3c81f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c74893123203fae1ad8050e640815fae46cdb7fde29ebfbefa3b6065bc0b820d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5c2c66b930801af0fcd5415e60c1646e4cd4d22f4cab4c51bdb2f5aa9db1a342\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7b596cdf84908424c0234d4546947508d061e01a9490fddfb346ada7a88d98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"567d9ef227a1b0e29d280dbfeb4eacab7843c88000a805f0ef359193c69a8189\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e40f041bd75dbf3b0658d7a49adba76e80113241cee931f90f0c37a1149955ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8713cb237dc57b8e8ced66f8cbc11fc7c18b377af9e36c0138a053141e4df20b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"ce3567b64c376474041ae5a790ea350039c7b065c373d3bc82afe2a18645e225\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"8a3503393c3e9bb4af6707deccbd9de501af9ca64c00bce65971025fe6d62c10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"053fe182975a90257bc91bb8a5ba18938a225856a6ec12e179a0dc901e82026c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6ed13fe5de1ff7dedfc61727996ffa62a24b166093c9d75c2f340d2dd813d7cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dad0c6ed4987ed315608a951935eb320ea90d0b7236754a5f14c216e2672149f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d4fa155ad06444715f5bdd7c86b935b8c3a09c0161684a34c5242e209fd1395e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d255f6849f684d6e9c587b3f81919950ca9931063d04bd20d428877e38cf32bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c831625dbd0f9e3494dc98ae61f4c722e508874473ed5dd3337e4d8b4a5ab8b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"de20c62aecea77c4f5b388cd06473e104621178deb4cf0c778e9e6a0dab0b2b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"0d9d3be3564a3100151a6e1ae1951f13156c7a924c22d306d33ed599169b3a8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"41be2b2d382e17f0d6fb6346c55ba1c2a1df17a426cfc91098af388907da6123\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6318789fe768d7c7c1bf509753a4278019fd033bf3264acfc3fdfb4736e405a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"550b741ebc8392a9c41d86bad794dfa1dac3e217cf38ae211b94ad3b460cf816\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b5a2bfa9c376e074f9d1a5fc1e74b4b8f2be7b2443cee6dc093b54b277b61812\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"d4f9476e079c86438a3e70bf00658c15da54d5affac927aca709f2a5a28a2856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"6d90fbb4b52441d45d1af633f0a5a1c7f4fdaac2beb5a19b805c85ac96e9ced5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b37b3c55782fc38e56fc7c8f891c162219d3ceb3cd7f0a4c2a524ec50e8161da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c5a1feb40731a163ade82e9f405b4d8dd54e59a876cebd6035483ebf43d073ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"5addad89ee48bb5ebc2fff94e068612b169a0543cf684ef8f91e03839a6b46aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"dd4e834b7175a5cf901f9c385d7d10e6783ec3856021a2d78890f5df8fd3d860\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"83d997eaacfd09bfc29a6f839961259fc137d16701d722788b8af24072a60cf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"602faff5ecaf80d48ceedcb6660ff57225a35d1a81dfd16de6c23c17b2c58e1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4fc416c6b94554b03be40292dd34bbe7f23edf74b3de1f2650f9cd17dc8c8dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2559fbf0028a5ba78bd30825f90d521639e7efcff44897276d57ea397c3521d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"00dd40de0fd03d4c4e442d21a39cc29666a793e485c24257ae6f5865d8dcafeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"93acb8e543c3570b87a029840646c64ab84aba25460ef6fde7be10e83afaefef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"fb609aa5491ba907805d2d8a79e6fd486398e0af827f29290c8550c4de9cc08b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"66a3a3221e645480d16e899f2ee66a0f903d082d098085ea6eb7cea5646a9a4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1eb7897d87b8324e162e8c157b519a2453ebc40421c65a5fb6b6cf3a99da37bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"47f2d0dad0904e4754a31b56bc3996015000d246a651cd7ae8a0c11a13c46d29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7e1eb9dec290fe93db72581dd65bd5fd27cc167d1e8123fc32d61e49b3882af0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"16ce1f8437f72a646ef479dfa8d9081aab6a8d15639d9a41302d1dcaeb83d480\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8a9aa2912542895fd0b2c1620fbbff56d6354a0244b869584a9421322d58549a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"3dcd0c3947e33253b1421b74217847eed8f5dad1afe3feda1a3f46868bb89d5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"65ca4d1635580c50567fead06bf8ddc00121f26e3c1b0af3588da26caa4031e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"d08fc10d786223e68c46b2831514aa962b8e810b48bce7c290fd5a9dc946e0c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4652f8a2150a4931901a27c005b2bb44d4d7d1212b652ba25bff4887be9a061d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"afe3e4fd6498dd752c1408d44d697c78067d9cfca49b8e17c957f1107bd29159\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7b5707c55f4a831b6c40c8de714355dc37f0769f3d01e3ab63089a574a5e90c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"c60828ca16ef84b7a5f682d52ef03cede85f017663e62fb9fbc0ad772dfd2ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b80f6cef2e969c1f008570634a903912fbb963e02b61fcd3d6eabc96e4d7e660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"ec22cae50a0d141359a788b23404a1b87020873e849f1c7f2821e4f4f589819f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8011907f4913a9f005064fa089a9485c460a80b7297b4e7706c2794bced53adb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"ea3f4ea4acf30bd44f150de33dd1c53f56bd31e718ea55da79b359501ae332ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"87ebeaa6eb266e52a2aeeffb20a6bfec05537473569fb827a1c21b7f4278a033\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fa7d0d6f93c4fe7b3a94fcb94afd6da2ab83b0ea6d135aa71da22c34993718e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"37cdaebbb9459c785c9575c5ac0f286daad6ed4c5aed53dddcc7bc477a218575\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c37f853416f0a9352736127603b1f84bc1be9730f83da4fc8da4e0aedf2c07e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"aab6da24089d86ef6744750ec37e3ae4ae54a659206c3db678eda83f7331c625\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e7cdfdfbf54424223419f523f1a4eb07195319bff0df2592a923437be7e0ddf9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d42d6ef898b5bb2f53c8be14ffeee02d873488450136c9cde9672f67f8b5db65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"18b34bcf475fd760\\\" || auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c256fd8bd371bcd3200dceaa60a34fd91fbe5b36d1fd2ec991ebc2490e9630a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7511c9e343a4a77a350a8f490a05d514a7fb3a7c49cba5959a484dff97a8d826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"bdd2a7ea22d1e652493a5199df68b6469e1d56e9f4cecd5730da55663f4ae048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"66c1d0d7977e242c1ab5ab2e30c9e5d38016fdb4efbc086cfe61f11b43028d1f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-58b06e"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:43.761Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-11ea30","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:27Z","generation":18,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5f9d701c-f599-44d0-846f-c2a7e5638d99\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:52Z"}],"name":"kuadrant-e2e-worker-w3-11ea30","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-11ea30","uid":"5f9d701c-f599-44d0-846f-c2a7e5638d99"}],"resourceVersion":"41546","uid":"d38a62c0-eb55-4f83-8e14-0f0bf8683fef"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"7e501414e2d808948b5eddaa7f3eb13b4877ce82957d2adebaf34a836c5ce444\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"fa4d09e98a2556f31180e48c4d9d80995168b68c25255a6617ff5fcec5af76d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0e265f41f92f25d7807dc08172a944eaac20288601372a86e930f1345946c867\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"8ac3a676eccce06c93a581175c31eefc5da410e70579309c902ab32597ac5f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"099db7f703bc18e91019eee55e14ea78311b9e8c006a6d80178b4427969bbe2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"d167486b3a286179f2a574734132194356fcf46fe317fbc094da630cd968b226\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"59ce02df7fa04b0cc60f0ea6f22aa086b0f51340de5d6c38e7697282ade95583\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"4bd8db4d8fde3b6527fddb55cfec241fb481828efbf9384f3e0afc5cf1134067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"290bb37a29b764a67d6d28298d3b239bc4fa201a3722b25741fd74ee359cbca8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9be45ffa797958c72a1a39203c0b588ed452ee5d9d252c5df9004f63ed498d07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ec7eda29a80355e79ad584ae112314a634ff966c3845c322adb4c7e30a115927\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"c946d75bac431574ecf87a5ba47e15caa560da872a09174b5036bf9f90c0ebd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"f7e700fd716c6572c297a61d035137c0a615240ceb902a6f605517e43cb3b51b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"024c8305fe118d0adf871619e5660208bb3382c0be529a41df5bf4c8b81e1a41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"02e591b14d1d911b248f6a57615920c164dc27ece5d75dc59e40f7c966017a86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"d6c7400827550730c2698f1fda6eab32d7ec1af6b7a019c1baa88a91919eae34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"48797135d73f587e843f75f61ae594882c62d94de2fad142f884d56b879787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"02778cc72718db248e0a19e01423d397465a06d51f9ccb69e6ebbfd24851cbf3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"5a8ec189257589d6eb2f8119a6e11a4ef922aa17b4e7f72784d8a4295931987b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"052c0658d6bef841b2dee7dfa4a1ac26c6104cb5e1b1b5ff1aa72d06ba0068aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5f33cfc21b53390e53f539550daf92821f9f9966396b0c1b8dffc81c79834ef3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"458fc67391ba189a51424b60a1833c6b3aac1b0d9a80b66bedc8a4bc0720cad4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e1263ac989787c1334fae799fad37ba5523a9c7fea8a3ced963e53e133ad05cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6634be4e1e349e075fa306fec4cc8d490cf8e09f34d63f6366662a1e5da80f59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"567cb1329c5ce873181f63aa9585b36cbdd31728ac0ff948e77b0038d7b0d639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0cc742b9a303446dd9839593bb0c73439ebe804c6983e77f44562d58f11d5bf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"a1b7750bd5e7b7007476ebb57ac4209b2603ef7fba2a1dfc6830a5e86f72b5ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"533f5e66529af854e63da092f4998096cda919d44d8f250f0bee8346a83b561c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"60dc4f43d30a83a433e7a7c8ec26760512fe3b6834045fed257f83519e1010b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"397ec11215416691c2d8065d6f12e30fb013ec47cb386ea293533603ce3c74d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ef2202f78c37e4bafa6be5121685839a838127cf98c583957df554688be0c13a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"61b462ba56beb0dd5c7a00db5ec898e65270993d6a30a37aa3f95c03740e42cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"6c33dffb6bfe6129da2f607bcaf300235c0c955b262eacfa84e45b66cbc52926\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"2831ae6371f9fcc08ab710fa949e52c2b1060e6692e034c9ac5336473e5e77c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c4e20feaa61d40b392e7c478b4878f1e369578fbfb2cdcbb2efa85fd0f42cb97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"7d11de4de428673bfe2ea958eeedb0f76eeeb719dbc4f94205024d3eb2d7a40d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e9bb7245f77cc45af3616db7e75d0905c9415f2cd7e6afb8e52b0903c5026fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"13f864bc48d9cb4c17311cc93c47e92f9e68f847b23fd1d989c1777bf12ecaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"ca4e394888dcdbbedd3071a78dacf7f7734b1637ce0022dd06d6c8d5db89a9d7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3889c79f942fd5cd87050886fa73bf885ce15f36f46450a0b06680e03f0945e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b51976e87d63318dca70c311ac6aa5346c87110ea930c83c8a7e6be98276cb68\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c042198a65c10a236d44152eb94d1c9ce282012744b5881818ac1c789776cc86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"064cd97002a8adf3f73a1c219c01ede3a466154324bf9c2d38ed802996fa1c93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"24055b76dd1b2b1074b2af17164520546ebf3584547ebb08222e57176c469cec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"0814649228590707265c0c5f4c05481a24e467825eb04f2cfe9b050cec451475\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"101523cf77328d6cc8d89b725b6358b5399ccbf12d0f5579fea9b252c21ed884\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6d1abdeb903d5c7409da81b9494cfb02588fce8bc268ce067c72281f3d2a3423\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bd98fc62222edd4f185fb418cc21b343cd8fb7dadb018d20322923343b635a23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23582f77e306c43fbb9c186dd67dce35dbac27b48c88e55ce95f824242e5c070\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"4653b49e1df2d1ad70ac0cb086bd25a161a083daa5623830bf9c23a4d32d81d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d273924852db8aadf7dd4228e0f5a246820a4ddd31c0a3f987b9bee859fcb85f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0f5c60927f2e0fa483306b2cb5bf209e25b290919908f47c32ecfb3f2d4ea741\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b9f85a204cf99a8911948f83837caa2637e403dd000a62a8fc8effcaed065b7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5d80974a71752b455cbe1cf7f6745663ec15276dc551e435604c507fc7e1f824\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"8ad362d32578f96da0402397f19717a43bb6b422cc88ff4f9f1fcd9f9f051ded\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"996699b8fde3fe7b82d7fee633be4828868331af28fd31564d51eafe4050a887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"b6cd3cb3d8fe6c97811a84bcefeb660f7df86ee280fdb597ead5f618d1f1ff9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"50366813a245c7608d0499fe96aa6bcb2aa44c936eaff981254612745a5997bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"3287a60b3c10d53d6c1dc921ce50cc0e03b5652bb4969c0f98a7844bcd398280\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"a94425a593076417c83b2a40f12a8ae3c5c6b662ea65b8547feb3da20c01a7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"33b8c81c912fc47e6e2de04cb9f5de615ad2f5719d8c77a44640d718076dd61b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5cb8b3de52308e835c6dba6ef21bbbd5cdcc08e3a265f908db28054feb938acd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9ba49527c258b531f2ee72b000f546a9ebfd260a661984e53298846f5ebcce92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ab28c9d732dd6eb9a5c664acc03cf1b527de0c2428670674b22dbf4902b0d28e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"797ae6033407ba51a6da601a47eb6f0aee25cffacff63d84822e2ead6e27cc17\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e20a7320c56120af7dde4839033f5c4891aa05d7c9eac837d45775e251dd40bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"1cf89413c4e9b557bee9f2d1b259d19dd3bdd194fa97af466a817747d338f22c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bceae3e6581f689850ae06da68761e7a9701cc2befc42b5db23b5de587eaa948\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6820726e004d8eb5c0fdc5bf7ceb2e9f78a4c533b6cd4ca0e024f6f2969a5489\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3740f1f42e103769f8eb7f75f85c2046536e7cd0ead852ec9eaacc5bb6b1828c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"92a48cb8cba483dd253a3593c7e275206a0068f8bf2edbe9cc778c48036b80eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"dba8d67f8dc748e736bddfde9787dcd9f2abc4734b33904c161dad62fd54eb51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23e5d03604f396cf0f7722326bd1ab80ece27d6aa17559855854e8ee3826a9df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"f69075aec72ac5316b8ba068397d9bdf8b100ff775c12f10dc7c4a33141e4e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"39dd8dd5a8484f7acdaf3dc3a0c56c3398c524eb4109939c214eb63699129f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"28bcc6325fdd4b99a4f30057dc26255507ed669f632fedbfe422e47bc4af05f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"816c0d35beb47f6d90c29c30bffa876aa137bb36f61871cfa8a2aec40877b53e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b5cc0bb9c7d9964759f7998f9585e1e621c82d9037273b378114680ff9987fd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" || auth.identity.selected_subscription_id == \\\"de7e0944c0e60e8f\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d6fc562ce8225bbeaea0c1a8d900c397a0f6ffdd32d289781d766cd6717275e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"222e4bc4c432b58101d67be0f5d1761ac686be63bd1cd2368af1e6ccd4ab2af1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e76915430709bf5feb36050c9e422151d907c366bbb29f3971af1c955b350a6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"fa6dfe6a45bf0083d1bbba31cc4b6ae0995579a3592c3a4aee778ecd3ef10c7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-11ea30"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:44.150Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-697182","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:34:06Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bd9a6cb4-b62e-417b-b7c7-1a492d09cb48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:38:03Z"}],"name":"kuadrant-e2e-praxis-a-697182","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-697182","uid":"bd9a6cb4-b62e-417b-b7c7-1a492d09cb48"}],"resourceVersion":"77231","uid":"373bb61b-a5f5-4bca-9293-56d39b2b5572"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"6bb756d3cb9cefdbedd33e3ffb0fef0fa01e8fd93126567db82895bd3a538d72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"6469f0886ae15bfa95f54b151a3911a3d6aaa746b16d804efc670381d4c0b992\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"48d502a3bfb921c62e67aa3b704f3ca3c1c5df56a16fb64e7a266b7dd905c443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"215dcada799074848fcc74580868b34cf79a6799341f2d3869e3c216bdb32358\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"5ba96920ad1fc0a5d38a71b96fd97866dd17f2be944ed551ca665228f11f8ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"c33005fbf2fc39b5eeeedbae5fd4fd3b56b51a42792ff1cdd282e3ca4a06eff5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"365a78a67bc185989c50e1cbd851cb098c437cf8ca147f174f40af4ce1fb69bf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"913e833f9cf6b4d26e4d59b94409bec257829b627a2865638a18c17e2e504241\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"032c8d8d097aaa749b90d9d6274e3867531eb2c3ab84b7ca0fe579f8dd776e5d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f933df876ef27cca7c9f4a691245ca2066499cf89096da05f770a45bc8aee35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"b5ac4f3d05be7aee9f06be958506581c31f244bbdbb276ed944af97f7150cb07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"43306fa4e8b92dcb3c9720febb98eeb170e90451da6e6bfc50d8a2bb9aa464ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"eb7638012556afa856ac7f56e30a5f9d390a85651ceeccaa24cbbd6602bf1550\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f1c8865631e08e6865222cf7c67b4f1e4fd3ef2e73aeedfeaafb0c62e922b30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"28813ae4dca3619bdabfb5e0cfae48bdb0fcda1b7b149eb3ee98638ca39ddff2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b26ce7ea2624e68545c0350ffa608ca4d5c967ac75f46f6f9faeb8f7ea009a95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"4ca99a322e50c5c71760f97f4987d6c904f2c7f1fc90c81ac8c4250460078eeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1798d55057b6d0cca6f9abd70585585f923cf50541f4ea327da38c6cbbb73344\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"945c17b1dc5fefc12961cac712d294110cbfda7f4c732cfc945baa22b5b887b3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-697182/praxis-route-697182/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"57a651d432e82fcb452972cb89bc08d73dfd5300a2be005e0d3c1b5abb3bc08c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"8789bc227f494df79e088ed7cfc76c5a775ecbea2945f8a4460d8244618c3553\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3d975a4971c2a9ae72f2a8ef8333eb45d4713d6277b59c26ef80d6bb2be42a9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"9881891989cbd2b050597cd45a85d8015db20576ec2151561f04312cf3a6eca1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-697182/praxis-route-697182/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb97d028680959de1290dbad1bdf5bfd2fd46c3dfd3f71a36e19ee29845fc15c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"4304af727ff43d6a76c886a6cdd580e7ac96d3526445914c7c32aba7f7ff18b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-697182/praxis-route-697182/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab0362982f33cf77e74bafb2ddf9b7b023e89e5427ad977283f4c41524814757\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"c764c57f164469919f03f530f997822bdefcaf260612b5cd99b5843b413cb1f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-697182/praxis-route-697182/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75f54bc5353c4d3063f1466e62a6e65e82a52c69fb2970273309c4b07570e244\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"5d1130455561ec68845db746c2278d38a8ff84463b9a35940a32612d211d7fb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-697182/praxis-route-697182')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"7f3a401d8131376569e6a438b7f803983a4721ed1f445b54ed578c76147214f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"19f1936177f8c2f0b172e90ca40e38f76764f58e7a58bccda05b45faf262e045\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"02289e54f3ea560652a8103a88149998efaa5003921b720ebb86c74779062ed0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"3fcc5c80e34a83cbdd185016eed94a9b8625c8bc74eb4328e6b2a9aeb397f54c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"431a305c8904de818aeaac387c5267630c7d7b25241f3ccc769c77c42015d200\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de6b376cdc353e536e687400afde64f53961d19e663d39be688a0737a2b2680e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2dc3012f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"dfaa406d6aeca91c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-697182/praxis-route-697182-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-697182/maas-trlp-praxis-route-697182\"]}],\"name\":\"fdf33223201e194f3565a032d3a0ae22b747911a01188b62faef60bb504fdd8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-697182/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-697182"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-697182\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:44.270Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-697182","namespace":"openshift-ingress","uid":"6d72df5a-d41e-49f5-ab27-bced33417c60","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-697182\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:44.511Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-praxis-route-697182","namespace":"ai-tenant-e2e-praxis-a-697182","uid":"2d660d4f-597d-49a7-af9a-c712afec52d9","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-praxis-route-697182\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:44.939Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:45.060Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:45.360Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:45.807Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-58b06e-kserve-route","namespace":"e2e-models-e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w2-58b06e-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:40:45.958Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"praxis-route-697182-kserve-route","namespace":"ai-tenant-e2e-praxis-a-697182","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"praxis-route-697182-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","reconcileID":"41b7fcc2-2fe2-4b00-9d6b-d196d6b6daa7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","reconcileID":"41b7fcc2-2fe2-4b00-9d6b-d196d6b6daa7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6990c5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6990c5","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-6990c5\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:40:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:40:56.430Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","TokenRateLimitPolicy","ConfigMap","HTTPRoute","EnvoyFilter","Limitador","AuthConfig"],"eventTypes":{"create":3,"delete":7,"update":13}}
{"level":"info","ts":"2026-11-04T00:40:56.751Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:56.813Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:40:59.038Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:40:59.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:40:59.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:40:59.355Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:40:59.416Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:02.330Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:02.337Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:41:02.340Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:02.340Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:02.330Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:41:02.353Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:41:02.414Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:41:02.414Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:41:04.676Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-enrichment-model-ref","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"b14dcfb4-6091-4479-910b-d9b19ebe8b9d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-enrichment-model-ref\" not found"}
{"level":"error","ts":"2026-11-04T00:41:05.531Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"1b262760-ac4d-402a-b820-7934910217d4","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w2-58b06e\" not found"}
{"level":"info","ts":"2026-11-04T00:41:05.593Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:05.593Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:41:05.914Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-22de5b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-22de5b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:41:06.754Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":2,"delete":6}}
{"level":"info","ts":"2026-11-04T00:41:11.816Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:41:11.816Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:11.825Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:41:11.827Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:11.827Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:11.840Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:41:11.913Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:41:11.913Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:41:11.972Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/509a124c837f7da9f28d2bbcf15a56e24544b0fcb53dff6a44396fafd0f4f0a6","error":"authconfigs.authorino.kuadrant.io \"509a124c837f7da9f28d2bbcf15a56e24544b0fcb53dff6a44396fafd0f4f0a6\" not found"}
{"level":"error","ts":"2026-11-04T00:41:12.026Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6352f36f596f507ef4e2f3c4ab34caa551d027a02bdb6782584a423613057be0","error":"authconfigs.authorino.kuadrant.io \"6352f36f596f507ef4e2f3c4ab34caa551d027a02bdb6782584a423613057be0\" not found"}
{"level":"error","ts":"2026-11-04T00:41:12.080Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5c00e488ae1dcf0837abfd5b1beac072f490d015662edad57e75a3c94d1859a3","error":"authconfigs.authorino.kuadrant.io \"5c00e488ae1dcf0837abfd5b1beac072f490d015662edad57e75a3c94d1859a3\" not found"}
{"level":"error","ts":"2026-11-04T00:41:12.136Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b7aa258184719e7b41d15f307a2b1fa808280e1ae28ca040b5894e2e89355808","error":"authconfigs.authorino.kuadrant.io \"b7aa258184719e7b41d15f307a2b1fa808280e1ae28ca040b5894e2e89355808\" not found"}
{"level":"error","ts":"2026-11-04T00:41:12.222Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ca3d3f64496c9053e18dc234a27ba89c4f3f6db3b61f42bd4c9db7e2f355ab66","error":"authconfigs.authorino.kuadrant.io \"ca3d3f64496c9053e18dc234a27ba89c4f3f6db3b61f42bd4c9db7e2f355ab66\" not found"}
{"level":"error","ts":"2026-11-04T00:41:12.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a8a5a9bf45c4853ce3c1a72a3cfab543246dfdb051bda66b9edc0372ebbe2105","error":"authconfigs.authorino.kuadrant.io \"a8a5a9bf45c4853ce3c1a72a3cfab543246dfdb051bda66b9edc0372ebbe2105\" not found"}
{"level":"error","ts":"2026-11-04T00:41:12.484Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-58b06e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":18,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4fcb948c-b646-4a79-81f0-c8c8b238ba80\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:40:35Z"}],"name":"kuadrant-e2e-worker-w2-58b06e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-58b06e","uid":"4fcb948c-b646-4a79-81f0-c8c8b238ba80"}],"resourceVersion":"81091","uid":"732b86e6-fa81-4635-acf0-7deb37d6eb21"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"e146aba91e806fec4ad460501c64f088e7918b3c7df4adc5b88bc6c3faf2ac37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"9dc9d9cec315591800c88f4289e106e101bea3f744c5b9e8db2e7bee888f56d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"63ec76d05da6d8eb8438f4440655f88e11dac33ecc007fa0c01af712b41e570a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"602b24d85c40ef1424ba4360695cdf69f8ff19714c62cbcceab51ed74fdbb3c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"91ef8a3906f365286d0019bcfbefc55ed221a2b34a354423d7e5aabecdfc1e41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fe787d97dad775e52b0925cb3b1fc11a2cccc1c1d01be7803ffa54e7a5c34f04\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"7518d66fa47f7f6cabe6c14b9e1911316826c977ac3ad6142125da82716ee49d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"dc090a0b1fa64108101227bd0e9b3c7a256183d61df5facdc28601f35312d1b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2a2f0db09cb2fb6f2f7fb7aae81d3230cdc54b055d10cab642b30512426ad32e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"a264fddac0eede3bb186a56c3d99c2c84f52da822bfe449896c63e80d378fa6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"975ea7be7a86f3bd7fd50267137f6de8065399993c7f63b59c191559e47f793b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"0550d6c99a9c75642299947f71e362196d9b4abf2094d7e3ae1dc4c1153628b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"a95a55523a043ed134414c098458e5a7d6983ab83c6259ae31d9d5fa9a8316c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5cf451c78d8f4be30e60bba48086bdc4cf8200cc3ebdbab4eb91c0d2d9e57068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"6118193c4ed945f459e205e00e6416c96e49516833c47b89d6ab4cf069c93dd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"1d7028f009a317db8afd1e93862135d0f18f2de709aa112b26db637814fd6ef1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"1369d79269306e5fa8bcaf6aa97220019e84961c9b6a9afc7b7b263f0ecb49b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"2480cdb507fa123566b39943d7f0d47eaddf130eba838a9db19503d4f513a022\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"9bc8ba0637406af8bf8245d440db5a33901d9b4f5074b872b15869bdd6287a09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"2124069b6a0d920b738a13569de3259650e6753b0f67ccee6180a5cae31b4c5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6ace09d0808b0cc3ec8485b92185031610ea8a5f271f1d1b8533399d7cd3c81f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c74893123203fae1ad8050e640815fae46cdb7fde29ebfbefa3b6065bc0b820d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5c2c66b930801af0fcd5415e60c1646e4cd4d22f4cab4c51bdb2f5aa9db1a342\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7b596cdf84908424c0234d4546947508d061e01a9490fddfb346ada7a88d98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"567d9ef227a1b0e29d280dbfeb4eacab7843c88000a805f0ef359193c69a8189\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"e40f041bd75dbf3b0658d7a49adba76e80113241cee931f90f0c37a1149955ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"8713cb237dc57b8e8ced66f8cbc11fc7c18b377af9e36c0138a053141e4df20b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"ce3567b64c376474041ae5a790ea350039c7b065c373d3bc82afe2a18645e225\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"8a3503393c3e9bb4af6707deccbd9de501af9ca64c00bce65971025fe6d62c10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"053fe182975a90257bc91bb8a5ba18938a225856a6ec12e179a0dc901e82026c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"6ed13fe5de1ff7dedfc61727996ffa62a24b166093c9d75c2f340d2dd813d7cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"dad0c6ed4987ed315608a951935eb320ea90d0b7236754a5f14c216e2672149f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d4fa155ad06444715f5bdd7c86b935b8c3a09c0161684a34c5242e209fd1395e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"d255f6849f684d6e9c587b3f81919950ca9931063d04bd20d428877e38cf32bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c831625dbd0f9e3494dc98ae61f4c722e508874473ed5dd3337e4d8b4a5ab8b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"de20c62aecea77c4f5b388cd06473e104621178deb4cf0c778e9e6a0dab0b2b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"0d9d3be3564a3100151a6e1ae1951f13156c7a924c22d306d33ed599169b3a8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"41be2b2d382e17f0d6fb6346c55ba1c2a1df17a426cfc91098af388907da6123\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6318789fe768d7c7c1bf509753a4278019fd033bf3264acfc3fdfb4736e405a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"550b741ebc8392a9c41d86bad794dfa1dac3e217cf38ae211b94ad3b460cf816\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"b5a2bfa9c376e074f9d1a5fc1e74b4b8f2be7b2443cee6dc093b54b277b61812\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"d4f9476e079c86438a3e70bf00658c15da54d5affac927aca709f2a5a28a2856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"6d90fbb4b52441d45d1af633f0a5a1c7f4fdaac2beb5a19b805c85ac96e9ced5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"b37b3c55782fc38e56fc7c8f891c162219d3ceb3cd7f0a4c2a524ec50e8161da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c5a1feb40731a163ade82e9f405b4d8dd54e59a876cebd6035483ebf43d073ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"5addad89ee48bb5ebc2fff94e068612b169a0543cf684ef8f91e03839a6b46aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"dd4e834b7175a5cf901f9c385d7d10e6783ec3856021a2d78890f5df8fd3d860\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"83d997eaacfd09bfc29a6f839961259fc137d16701d722788b8af24072a60cf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"602faff5ecaf80d48ceedcb6660ff57225a35d1a81dfd16de6c23c17b2c58e1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"4fc416c6b94554b03be40292dd34bbe7f23edf74b3de1f2650f9cd17dc8c8dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2559fbf0028a5ba78bd30825f90d521639e7efcff44897276d57ea397c3521d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"00dd40de0fd03d4c4e442d21a39cc29666a793e485c24257ae6f5865d8dcafeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"93acb8e543c3570b87a029840646c64ab84aba25460ef6fde7be10e83afaefef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"fb609aa5491ba907805d2d8a79e6fd486398e0af827f29290c8550c4de9cc08b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"66a3a3221e645480d16e899f2ee66a0f903d082d098085ea6eb7cea5646a9a4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"1eb7897d87b8324e162e8c157b519a2453ebc40421c65a5fb6b6cf3a99da37bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"47f2d0dad0904e4754a31b56bc3996015000d246a651cd7ae8a0c11a13c46d29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"7e1eb9dec290fe93db72581dd65bd5fd27cc167d1e8123fc32d61e49b3882af0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"16ce1f8437f72a646ef479dfa8d9081aab6a8d15639d9a41302d1dcaeb83d480\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"8a9aa2912542895fd0b2c1620fbbff56d6354a0244b869584a9421322d58549a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"3dcd0c3947e33253b1421b74217847eed8f5dad1afe3feda1a3f46868bb89d5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"65ca4d1635580c50567fead06bf8ddc00121f26e3c1b0af3588da26caa4031e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"d08fc10d786223e68c46b2831514aa962b8e810b48bce7c290fd5a9dc946e0c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"4652f8a2150a4931901a27c005b2bb44d4d7d1212b652ba25bff4887be9a061d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"afe3e4fd6498dd752c1408d44d697c78067d9cfca49b8e17c957f1107bd29159\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"7b5707c55f4a831b6c40c8de714355dc37f0769f3d01e3ab63089a574a5e90c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"c60828ca16ef84b7a5f682d52ef03cede85f017663e62fb9fbc0ad772dfd2ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"b80f6cef2e969c1f008570634a903912fbb963e02b61fcd3d6eabc96e4d7e660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"ec22cae50a0d141359a788b23404a1b87020873e849f1c7f2821e4f4f589819f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"8011907f4913a9f005064fa089a9485c460a80b7297b4e7706c2794bced53adb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"ea3f4ea4acf30bd44f150de33dd1c53f56bd31e718ea55da79b359501ae332ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"87ebeaa6eb266e52a2aeeffb20a6bfec05537473569fb827a1c21b7f4278a033\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fa7d0d6f93c4fe7b3a94fcb94afd6da2ab83b0ea6d135aa71da22c34993718e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"37cdaebbb9459c785c9575c5ac0f286daad6ed4c5aed53dddcc7bc477a218575\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c37f853416f0a9352736127603b1f84bc1be9730f83da4fc8da4e0aedf2c07e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"aab6da24089d86ef6744750ec37e3ae4ae54a659206c3db678eda83f7331c625\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e7cdfdfbf54424223419f523f1a4eb07195319bff0df2592a923437be7e0ddf9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d42d6ef898b5bb2f53c8be14ffeee02d873488450136c9cde9672f67f8b5db65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c256fd8bd371bcd3200dceaa60a34fd91fbe5b36d1fd2ec991ebc2490e9630a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7511c9e343a4a77a350a8f490a05d514a7fb3a7c49cba5959a484dff97a8d826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__58fae858\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6a493e9d74e90805\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e\"]}],\"name\":\"bdd2a7ea22d1e652493a5199df68b6469e1d56e9f4cecd5730da55663f4ae048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__40356ddb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"ec4474103b86d54f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-2-w2-58b06e\"]}],\"name\":\"66c1d0d7977e242c1ab5ab2e30c9e5d38016fdb4efbc086cfe61f11b43028d1f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-58b06e"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:12.760Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-11ea30","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:27Z","generation":19,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5f9d701c-f599-44d0-846f-c2a7e5638d99\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:40:35Z"}],"name":"kuadrant-e2e-worker-w3-11ea30","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-11ea30","uid":"5f9d701c-f599-44d0-846f-c2a7e5638d99"}],"resourceVersion":"81082","uid":"d38a62c0-eb55-4f83-8e14-0f0bf8683fef"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"7e501414e2d808948b5eddaa7f3eb13b4877ce82957d2adebaf34a836c5ce444\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"fa4d09e98a2556f31180e48c4d9d80995168b68c25255a6617ff5fcec5af76d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0e265f41f92f25d7807dc08172a944eaac20288601372a86e930f1345946c867\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"8ac3a676eccce06c93a581175c31eefc5da410e70579309c902ab32597ac5f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"099db7f703bc18e91019eee55e14ea78311b9e8c006a6d80178b4427969bbe2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"d167486b3a286179f2a574734132194356fcf46fe317fbc094da630cd968b226\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"59ce02df7fa04b0cc60f0ea6f22aa086b0f51340de5d6c38e7697282ade95583\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"4bd8db4d8fde3b6527fddb55cfec241fb481828efbf9384f3e0afc5cf1134067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"290bb37a29b764a67d6d28298d3b239bc4fa201a3722b25741fd74ee359cbca8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9be45ffa797958c72a1a39203c0b588ed452ee5d9d252c5df9004f63ed498d07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ec7eda29a80355e79ad584ae112314a634ff966c3845c322adb4c7e30a115927\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"c946d75bac431574ecf87a5ba47e15caa560da872a09174b5036bf9f90c0ebd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"f7e700fd716c6572c297a61d035137c0a615240ceb902a6f605517e43cb3b51b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"024c8305fe118d0adf871619e5660208bb3382c0be529a41df5bf4c8b81e1a41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"02e591b14d1d911b248f6a57615920c164dc27ece5d75dc59e40f7c966017a86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"d6c7400827550730c2698f1fda6eab32d7ec1af6b7a019c1baa88a91919eae34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"48797135d73f587e843f75f61ae594882c62d94de2fad142f884d56b879787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"02778cc72718db248e0a19e01423d397465a06d51f9ccb69e6ebbfd24851cbf3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"5a8ec189257589d6eb2f8119a6e11a4ef922aa17b4e7f72784d8a4295931987b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"052c0658d6bef841b2dee7dfa4a1ac26c6104cb5e1b1b5ff1aa72d06ba0068aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5f33cfc21b53390e53f539550daf92821f9f9966396b0c1b8dffc81c79834ef3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"458fc67391ba189a51424b60a1833c6b3aac1b0d9a80b66bedc8a4bc0720cad4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e1263ac989787c1334fae799fad37ba5523a9c7fea8a3ced963e53e133ad05cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6634be4e1e349e075fa306fec4cc8d490cf8e09f34d63f6366662a1e5da80f59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"567cb1329c5ce873181f63aa9585b36cbdd31728ac0ff948e77b0038d7b0d639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0cc742b9a303446dd9839593bb0c73439ebe804c6983e77f44562d58f11d5bf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"a1b7750bd5e7b7007476ebb57ac4209b2603ef7fba2a1dfc6830a5e86f72b5ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"533f5e66529af854e63da092f4998096cda919d44d8f250f0bee8346a83b561c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"60dc4f43d30a83a433e7a7c8ec26760512fe3b6834045fed257f83519e1010b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"397ec11215416691c2d8065d6f12e30fb013ec47cb386ea293533603ce3c74d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ef2202f78c37e4bafa6be5121685839a838127cf98c583957df554688be0c13a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"61b462ba56beb0dd5c7a00db5ec898e65270993d6a30a37aa3f95c03740e42cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"6c33dffb6bfe6129da2f607bcaf300235c0c955b262eacfa84e45b66cbc52926\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"2831ae6371f9fcc08ab710fa949e52c2b1060e6692e034c9ac5336473e5e77c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c4e20feaa61d40b392e7c478b4878f1e369578fbfb2cdcbb2efa85fd0f42cb97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"7d11de4de428673bfe2ea958eeedb0f76eeeb719dbc4f94205024d3eb2d7a40d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e9bb7245f77cc45af3616db7e75d0905c9415f2cd7e6afb8e52b0903c5026fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"13f864bc48d9cb4c17311cc93c47e92f9e68f847b23fd1d989c1777bf12ecaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"ca4e394888dcdbbedd3071a78dacf7f7734b1637ce0022dd06d6c8d5db89a9d7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3889c79f942fd5cd87050886fa73bf885ce15f36f46450a0b06680e03f0945e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b51976e87d63318dca70c311ac6aa5346c87110ea930c83c8a7e6be98276cb68\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"c042198a65c10a236d44152eb94d1c9ce282012744b5881818ac1c789776cc86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"064cd97002a8adf3f73a1c219c01ede3a466154324bf9c2d38ed802996fa1c93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"24055b76dd1b2b1074b2af17164520546ebf3584547ebb08222e57176c469cec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"0814649228590707265c0c5f4c05481a24e467825eb04f2cfe9b050cec451475\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"101523cf77328d6cc8d89b725b6358b5399ccbf12d0f5579fea9b252c21ed884\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6d1abdeb903d5c7409da81b9494cfb02588fce8bc268ce067c72281f3d2a3423\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bd98fc62222edd4f185fb418cc21b343cd8fb7dadb018d20322923343b635a23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23582f77e306c43fbb9c186dd67dce35dbac27b48c88e55ce95f824242e5c070\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"4653b49e1df2d1ad70ac0cb086bd25a161a083daa5623830bf9c23a4d32d81d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d273924852db8aadf7dd4228e0f5a246820a4ddd31c0a3f987b9bee859fcb85f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0f5c60927f2e0fa483306b2cb5bf209e25b290919908f47c32ecfb3f2d4ea741\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b9f85a204cf99a8911948f83837caa2637e403dd000a62a8fc8effcaed065b7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5d80974a71752b455cbe1cf7f6745663ec15276dc551e435604c507fc7e1f824\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"8ad362d32578f96da0402397f19717a43bb6b422cc88ff4f9f1fcd9f9f051ded\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"996699b8fde3fe7b82d7fee633be4828868331af28fd31564d51eafe4050a887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"b6cd3cb3d8fe6c97811a84bcefeb660f7df86ee280fdb597ead5f618d1f1ff9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"50366813a245c7608d0499fe96aa6bcb2aa44c936eaff981254612745a5997bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"3287a60b3c10d53d6c1dc921ce50cc0e03b5652bb4969c0f98a7844bcd398280\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"a94425a593076417c83b2a40f12a8ae3c5c6b662ea65b8547feb3da20c01a7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"33b8c81c912fc47e6e2de04cb9f5de615ad2f5719d8c77a44640d718076dd61b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"5cb8b3de52308e835c6dba6ef21bbbd5cdcc08e3a265f908db28054feb938acd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9ba49527c258b531f2ee72b000f546a9ebfd260a661984e53298846f5ebcce92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ab28c9d732dd6eb9a5c664acc03cf1b527de0c2428670674b22dbf4902b0d28e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"797ae6033407ba51a6da601a47eb6f0aee25cffacff63d84822e2ead6e27cc17\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e20a7320c56120af7dde4839033f5c4891aa05d7c9eac837d45775e251dd40bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"1cf89413c4e9b557bee9f2d1b259d19dd3bdd194fa97af466a817747d338f22c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bceae3e6581f689850ae06da68761e7a9701cc2befc42b5db23b5de587eaa948\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6820726e004d8eb5c0fdc5bf7ceb2e9f78a4c533b6cd4ca0e024f6f2969a5489\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3740f1f42e103769f8eb7f75f85c2046536e7cd0ead852ec9eaacc5bb6b1828c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"92a48cb8cba483dd253a3593c7e275206a0068f8bf2edbe9cc778c48036b80eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"dba8d67f8dc748e736bddfde9787dcd9f2abc4734b33904c161dad62fd54eb51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23e5d03604f396cf0f7722326bd1ab80ece27d6aa17559855854e8ee3826a9df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"f69075aec72ac5316b8ba068397d9bdf8b100ff775c12f10dc7c4a33141e4e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"39dd8dd5a8484f7acdaf3dc3a0c56c3398c524eb4109939c214eb63699129f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"28bcc6325fdd4b99a4f30057dc26255507ed669f632fedbfe422e47bc4af05f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"816c0d35beb47f6d90c29c30bffa876aa137bb36f61871cfa8a2aec40877b53e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b5cc0bb9c7d9964759f7998f9585e1e621c82d9037273b378114680ff9987fd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__a3fc8704\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2544a363903f2702\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-simulator-w3-11ea30\"]}],\"name\":\"d6fc562ce8225bbeaea0c1a8d900c397a0f6ffdd32d289781d766cd6717275e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"222e4bc4c432b58101d67be0f5d1761ac686be63bd1cd2368af1e6ccd4ab2af1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e76915430709bf5feb36050c9e422151d907c366bbb29f3971af1c955b350a6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"fa6dfe6a45bf0083d1bbba31cc4b6ae0995579a3592c3a4aee778ecd3ef10c7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-11ea30"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:12.923Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-de0ea2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"6e7eb8f6-4c81-49df-885a-1cfd92034b41\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:18Z"}],"name":"kuadrant-e2e-worker-w4-de0ea2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-de0ea2","uid":"6e7eb8f6-4c81-49df-885a-1cfd92034b41"}],"resourceVersion":"42392","uid":"ad417c34-a43f-49c3-8386-dfcd19d97287"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"8f41f5d27f92196508ddee2fc47e51daf5af5c4825a7e8591ede0800be949fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7a4e12ba594de064264e5a79bafadfb910f6fe0c5c088cc1d86aa478feff909\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"545e35b30c59a1aa62ea994b7a5be31f8d3760ca10aeb1ba456d4eea87cf7a6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"a4133ad72b872fc03206a842894304ad17b775369b97a617c5b595bdc943e826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"771078d889ef85b81946eff0b2ff32fbabcda38cbb208fa37bb96509f7d979a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"bba5991046822f1b6e0758327a2491b9658a798d2b607b2a7144f024f0067676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"6d451581ca6171a655cb504496641e173bb76b72741c6c02eaed94083a536735\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"46cfece21c467f625b03ba5a104af0b1e8d4a213c5695ef30a112544f1c16cbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9d157bb2d1741f38e7e5854412ecaf7c47f4b489927c97cca666d33d1bb4d834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"a6089be44340b73e309196db9a8c89f042bf2d2570f1e88b8378d364827acdbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"d186d8e5e42a867e2a08face337b9772aeae6ba493c896ca867692f02c4456e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"8d1e7b487515ecba92117549552071598f9233e149b32fc4eb13567225116a07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"68a9c4eb18e71677a594352b1b7ad0325a4c685212ace060db3b90da668c6f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"5cd2749f5fa499321c3a48c9e432951a046807348668fc35fed27b72ac6db3cf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"9d55be3daa24118dde3ad2d28e0c6b48c00dd4df682a4745fb2c1e69a0bb735c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d5d96025b93f14012073fc9c61dbf91db95fa9ca2b726ddb91f601e538620862\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"06e46d8eb2da8005de0d157a8845a587567d7612ef6f79fc810ddaf2f78d6bb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"66272d32af643987684100422c0268e207c651a098012b0f2f6c77f68bc6d25f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"84d595c1af2ff8ed9ca0194212a4eeb97f3de15fbf7e225e4c6eb56d5a39f8e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"c13145cd6f1056971233d0e758c11ce8cee133a64eb3cf6a02b122d5a29a71a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"31e47065c52fb96c2470ed21a3d45c533ef5c080afe214081ff5637fa2b0d420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1b9a9d0030ed877e95dea36c3d55d7589cb8b6b826be9455de9bcdccb31c4a39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7db200bfe44cc9433850257d064b4edb5240dd6951e2251e271d79ce2599c45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"042db8e6145979020b4aa2ccc468918dcb1f32d03a1880a86a855cf8560eb16f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"5c91323526e4e1197474b1874d1ec0a636c457a84e2013e3688214b3c9f40292\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"56ff390a2f15a60052acfb6c577c0d99916ec6f8ec0c500a95983e8cd3ea840a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"26bea37b48ab2ee00f259c3b8c9bc4c47b26a86a798c02dc31f2843e47829ca7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"19013eb61834602135d4d3c8ffee368d3060b9b63fc5f9bf0951d431b8c38fdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"3b814cb972103fb740b36a5d13d0e90ab61a2243933f933f775c42677c1a5d85\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e7c8f0c364705957418c58fc49a204d16bc88650633ba572edfd632ab77f5666\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"91cab405f0636396c7771c6dc75f806c2ca022fb0848ae3c2fcbb33e22a339ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"67532e0078356f799dfcf346f3e77095d0c624d2d10cdeaa6e88f469fbb87049\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1b04bb6432aa7ede0fec0fc20a68d9446f453e5c05a3adfd45bf17a6f8b9ebc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d0d9929f02171b1ab4c86941d9f44cb58b54eeb19d2f221229eb30f01bcf7375\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"566ec84294cde50603c3dfa36bdf2a31651f5466d00e709b76f896a26cdc6f50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"6bf0b16aa8962b07d84f7048f7b90a0b18983bd80e9edb53eef17bed17344e99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"12b5dd9ded539680a4677101fbb814ed65f93d791dfecc06a4e34ac1ca666285\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3feb12b2847f536be51d0b1e92294157bff9383e20f2265f92e3ea76cb048d9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9b267730031d7c70062f248c5d4811c04b382ca0287062b64928d46b92989d20\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"fd11e09603fe10b92e5b13701b94b1bc51bd77fefaef648e1161701b5fa58e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"68bd4c49aaa83b70448e00df2203ce7ce94bfe9c263e924f642ee7ca2732c5e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"f72767414d30bcfd4e1eb5788ae3b97e09949d30d08ca78756af19a21889315d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"685672fdf62a49b437cb02b0a5cf31117061b1cb305120627a24d822b87448b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"28b61973b7f554ada23df8f2adbcef9c3140a267f58ebf2ee8fb91ca7b72c4a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dac478a38580f45da71c649418701234a58fe64e526cb6afb7481ba444836b2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"36b0f5aa2c414392caa7ffd3bb635d11e950c904103befcfeb425d09f5b9dd48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"90c38ac2efd8fc638edcb5f7c8693ef7a3280fbb60b050b3849a607a39eaf69d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"03f1f356a7d76e767be8c0f275a64f6b98f09a8f3d04640561ef4c3f580d2783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"4402031351082e527488b2a5cccf7d68722dece1fa01370d5c21333ca6505522\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"b9c11f37fe72e97b7a55dae48d999a758e39f367ad7a116d7c28ae2380778fe1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1fae005cfbffbe4e3aaf50dbb8dd3b5a9f584045e1475c7738a315467ec67d5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"135dd5eacaaaeb159be4c9871fe73af3bfd928f5de1be32e147f296965866b96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"336d069594861bb5e759f874cb7b2f97e4c07a0dcd6170a429970f5f2d53ac0b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dfc32b1869457c56bed8d097b7c0a22a2a0b12e527f2acb8733ab9067d057c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e25322c24d98be7252f7c79cda0327987ee6ee4733d332ed5901e1b273397c89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"00bc5328f6973fb2115cb694774124ef334eba1a1cfc7badbab358850a407a44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"1f9f53047b22c1c17c09acdb0fd9c17eb0638398ecc1a9a37a86b01d811cccb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"96d4f3037b42b8b4dbb2b4c60ec972ab8af4ae9746f33d3238fb10f28f178b9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"310e1acfd0057c6e83529a4c7d8365e210e81104c28ddd0e12bf7c27c4f96a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"78c96b65770748aed921a19b6a2bd36cc8321c0a7dec5651a52e25bab7ad2164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dfcdd2ad233477f91e46e790091a8a25cccde3e540e5dfee8a882e70548b396d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"32a037705f978b303327717e1c0ec5e2335c0b26c10797f521b5135cf6a2453a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e6a99dc788b835aacddb6627c89f73143a475188279769039fa67efd06d375ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9960c39f056ac6bfdf36a15fd9c1fa7c853b27ad278ebc44f7ec6e94d68172d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"7287734b84ceef6341393a90e3ed4982016519f2ef7f9218e0807c5b41fe5f8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"45872a4dc74f3d9c8887e6e6522fcc3828da98c8175226158ad7d1e0d3a30127\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"688f84a7dff8577d0e7ac9a7d4ec36ff7dbdda50d779bc6b57d6aae8ce8b2fa7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"435ffa54404a9fbb884e542d138a68cfb6613f929fac5c1d075c32a78366f2c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"41543e9b40d595358566e7bb5bcbb2fccbbbe2135adcd30f456cbd888d802a5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"4aa7d5ab26c862da3f59d51848309ebfd14dd317c39eeefa3ea8a80838fbb716\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"80cec2e610c1806df05551724b800f012f0c084c1813547c1bbd670985b653f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"74df5489e7dfa47ee79eee83e342918f6531e925cfe1a798956b35da601d884d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"ceac94fca2ae9ea5cc47f3df0ec9d6a10b6251c722a213562fa646ea167dcdce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e619c29e635edd15be7867ccd71c115af280811a435be9acf9042fe6ce2369a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"836cd1aaeda4d6b267aa83969a7f76f361d3884106e3fe9a1a411ebc103c733b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"58317c757c8a458d1a8d6d5b7d8a3528d73c19d945347d61d3167c58a9f2abf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"811ca47fdaa1feef5760290388150e142b3763ef459a60d86cb3e223c6af9a2e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"484761bfa30c42040a68a552fd37e9c6794f6d1979ee07beb44e5d6b81c5f2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"c98397041d5e3535484e38692edcddb66bc94af55a8aefe7b372827b5b9a3658\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"df7b3104a100478ba86ef3efa2a83b687d49ec85b07c62e635a293b710028281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__d78c1684\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f4f5ebf2e59540b6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"3fe8aaa75098b89c44ca3fe5a5cfc62dfa76bcc518cd59e8843f2e901b0a131d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"cfa45a246c21e687ad88a5b47e3484a2e94f500826f168a1b20a49a1094bc73c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-de0ea2"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:13.711Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"0dd1cccf-824b-4704-8803-8c67fd392e3d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w2-58b06e\" not found"}
{"level":"error","ts":"2026-11-04T00:41:13.770Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:14.139Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:14.505Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:14.624Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"1b262760-ac4d-402a-b820-7934910217d4","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w2-58b06e\": StorageError: invalid object, Code: 4, Key: /kubernetes.io/kuadrant.io/tokenratelimitpolicies/e2e-models-e2e-worker-w2-58b06e/maas-trlp-distinct-w2-58b06e, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: 1b262760-ac4d-402a-b820-7934910217d4, UID in object meta: 7a6a4df1-06db-45c1-ab45-a2ab60a54869"}
{"level":"error","ts":"2026-11-04T00:41:14.681Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-enrichment-model-ref","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"b14dcfb4-6091-4479-910b-d9b19ebe8b9d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-enrichment-model-ref\" not found"}
{"level":"info","ts":"2026-11-04T00:41:14.681Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:14.682Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:41:14.874Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-22de5b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-22de5b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:14.982Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-58b06e-kserve-route","namespace":"e2e-models-e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w2-58b06e-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:15.087Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w2-58b06e-kserve-route","namespace":"e2e-models-e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w2-58b06e-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:15.175Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w4-de0ea2-kserve-route","namespace":"e2e-models-e2e-worker-w4-de0ea2","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w4-de0ea2-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:41:25.684Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","ConfigMap","HTTPRoute","Gateway","Limitador","AuthConfig"],"eventTypes":{"create":1,"delete":9,"update":12}}
{"level":"info","ts":"2026-11-04T00:41:25.824Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:27.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:41:27.814Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:41:27.814Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:30.955Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:41:30.962Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:30.962Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:30.965Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:30.972Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:41:30.974Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:41:31.085Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","reconcileID":"83004c18-3282-435b-a17c-9ad0fd08cdc0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:41:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:41:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:41:34.018Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:34.019Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:41:34.236Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-a4fac5","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:41:34Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:41:34Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:41:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:41:34Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","reconcileID":"becfcff3-e1d0-4efa-b81d-b64263693ba3","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:41:34Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","reconcileID":"becfcff3-e1d0-4efa-b81d-b64263693ba3"}
{"level":"error","ts":"2026-11-04T00:41:34Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","reconcileID":"becfcff3-e1d0-4efa-b81d-b64263693ba3","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:41:34Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","reconcileID":"187be5fa-db48-4b2b-9a5c-8d0993288d95","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:41:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:41:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:41:35Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:41:35Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:41:35Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:41:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:41:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:41:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:41:35.339Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","AuthPolicy","HTTPRoute"],"eventTypes":{"create":1,"delete":3,"update":3}}
{"level":"info","ts":"2026-11-04T00:41:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:41:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:41:36Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:41:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:41:39.921Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:41:39.929Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:39.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:39.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:39.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:41:39.936Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:41:40.039Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:41:40.039Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:41:40.044Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-5"},"creationTimestamp":"2026-11-04T00:34:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:39:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:39:16Z"}],"name":"8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4","namespace":"kuadrant-system","resourceVersion":"78962","uid":"075859da-462e-4bec-99c8-fdde28ead235"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:40.114Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-4"},"creationTimestamp":"2026-11-04T00:34:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:39:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:39:16Z"}],"name":"554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b","namespace":"kuadrant-system","resourceVersion":"78964","uid":"e79f2d3e-6969-489f-91e4-cb8efb5b8a89"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:40.183Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-3"},"creationTimestamp":"2026-11-04T00:34:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:39:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:39:15Z"}],"name":"a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8","namespace":"kuadrant-system","resourceVersion":"78921","uid":"df16c070-1d90-457e-8bb4-941f35538583"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:40.276Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-2"},"creationTimestamp":"2026-11-04T00:34:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:39:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:39:15Z"}],"name":"920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338","namespace":"kuadrant-system","resourceVersion":"78916","uid":"dec3966f-0266-4f44-9466-ebfe60564e38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:40.382Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-6"},"creationTimestamp":"2026-11-04T00:34:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:39:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:39:16Z"}],"name":"0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989","namespace":"kuadrant-system","resourceVersion":"78958","uid":"c7222041-463e-486a-8e13-9a196667a80a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:40.385Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-58b06e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":19,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4fcb948c-b646-4a79-81f0-c8c8b238ba80\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:03Z"}],"name":"kuadrant-e2e-worker-w2-58b06e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-58b06e","uid":"4fcb948c-b646-4a79-81f0-c8c8b238ba80"}],"resourceVersion":"82153","uid":"732b86e6-fa81-4635-acf0-7deb37d6eb21"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"e146aba91e806fec4ad460501c64f088e7918b3c7df4adc5b88bc6c3faf2ac37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"9dc9d9cec315591800c88f4289e106e101bea3f744c5b9e8db2e7bee888f56d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"63ec76d05da6d8eb8438f4440655f88e11dac33ecc007fa0c01af712b41e570a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"602b24d85c40ef1424ba4360695cdf69f8ff19714c62cbcceab51ed74fdbb3c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"91ef8a3906f365286d0019bcfbefc55ed221a2b34a354423d7e5aabecdfc1e41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fe787d97dad775e52b0925cb3b1fc11a2cccc1c1d01be7803ffa54e7a5c34f04\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7518d66fa47f7f6cabe6c14b9e1911316826c977ac3ad6142125da82716ee49d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dc090a0b1fa64108101227bd0e9b3c7a256183d61df5facdc28601f35312d1b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2a2f0db09cb2fb6f2f7fb7aae81d3230cdc54b055d10cab642b30512426ad32e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"a264fddac0eede3bb186a56c3d99c2c84f52da822bfe449896c63e80d378fa6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"975ea7be7a86f3bd7fd50267137f6de8065399993c7f63b59c191559e47f793b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"0550d6c99a9c75642299947f71e362196d9b4abf2094d7e3ae1dc4c1153628b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"a95a55523a043ed134414c098458e5a7d6983ab83c6259ae31d9d5fa9a8316c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5cf451c78d8f4be30e60bba48086bdc4cf8200cc3ebdbab4eb91c0d2d9e57068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6118193c4ed945f459e205e00e6416c96e49516833c47b89d6ab4cf069c93dd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1d7028f009a317db8afd1e93862135d0f18f2de709aa112b26db637814fd6ef1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"1369d79269306e5fa8bcaf6aa97220019e84961c9b6a9afc7b7b263f0ecb49b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"2480cdb507fa123566b39943d7f0d47eaddf130eba838a9db19503d4f513a022\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"9bc8ba0637406af8bf8245d440db5a33901d9b4f5074b872b15869bdd6287a09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"2124069b6a0d920b738a13569de3259650e6753b0f67ccee6180a5cae31b4c5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6ace09d0808b0cc3ec8485b92185031610ea8a5f271f1d1b8533399d7cd3c81f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c74893123203fae1ad8050e640815fae46cdb7fde29ebfbefa3b6065bc0b820d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5c2c66b930801af0fcd5415e60c1646e4cd4d22f4cab4c51bdb2f5aa9db1a342\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7b596cdf84908424c0234d4546947508d061e01a9490fddfb346ada7a88d98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"567d9ef227a1b0e29d280dbfeb4eacab7843c88000a805f0ef359193c69a8189\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e40f041bd75dbf3b0658d7a49adba76e80113241cee931f90f0c37a1149955ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8713cb237dc57b8e8ced66f8cbc11fc7c18b377af9e36c0138a053141e4df20b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"ce3567b64c376474041ae5a790ea350039c7b065c373d3bc82afe2a18645e225\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"8a3503393c3e9bb4af6707deccbd9de501af9ca64c00bce65971025fe6d62c10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"053fe182975a90257bc91bb8a5ba18938a225856a6ec12e179a0dc901e82026c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6ed13fe5de1ff7dedfc61727996ffa62a24b166093c9d75c2f340d2dd813d7cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dad0c6ed4987ed315608a951935eb320ea90d0b7236754a5f14c216e2672149f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d4fa155ad06444715f5bdd7c86b935b8c3a09c0161684a34c5242e209fd1395e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d255f6849f684d6e9c587b3f81919950ca9931063d04bd20d428877e38cf32bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c831625dbd0f9e3494dc98ae61f4c722e508874473ed5dd3337e4d8b4a5ab8b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"de20c62aecea77c4f5b388cd06473e104621178deb4cf0c778e9e6a0dab0b2b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"0d9d3be3564a3100151a6e1ae1951f13156c7a924c22d306d33ed599169b3a8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"41be2b2d382e17f0d6fb6346c55ba1c2a1df17a426cfc91098af388907da6123\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"6318789fe768d7c7c1bf509753a4278019fd033bf3264acfc3fdfb4736e405a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"550b741ebc8392a9c41d86bad794dfa1dac3e217cf38ae211b94ad3b460cf816\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b5a2bfa9c376e074f9d1a5fc1e74b4b8f2be7b2443cee6dc093b54b277b61812\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"d4f9476e079c86438a3e70bf00658c15da54d5affac927aca709f2a5a28a2856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"6d90fbb4b52441d45d1af633f0a5a1c7f4fdaac2beb5a19b805c85ac96e9ced5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b37b3c55782fc38e56fc7c8f891c162219d3ceb3cd7f0a4c2a524ec50e8161da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c5a1feb40731a163ade82e9f405b4d8dd54e59a876cebd6035483ebf43d073ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"5addad89ee48bb5ebc2fff94e068612b169a0543cf684ef8f91e03839a6b46aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"dd4e834b7175a5cf901f9c385d7d10e6783ec3856021a2d78890f5df8fd3d860\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"83d997eaacfd09bfc29a6f839961259fc137d16701d722788b8af24072a60cf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"602faff5ecaf80d48ceedcb6660ff57225a35d1a81dfd16de6c23c17b2c58e1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4fc416c6b94554b03be40292dd34bbe7f23edf74b3de1f2650f9cd17dc8c8dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"2559fbf0028a5ba78bd30825f90d521639e7efcff44897276d57ea397c3521d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"00dd40de0fd03d4c4e442d21a39cc29666a793e485c24257ae6f5865d8dcafeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"93acb8e543c3570b87a029840646c64ab84aba25460ef6fde7be10e83afaefef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"fb609aa5491ba907805d2d8a79e6fd486398e0af827f29290c8550c4de9cc08b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"66a3a3221e645480d16e899f2ee66a0f903d082d098085ea6eb7cea5646a9a4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1eb7897d87b8324e162e8c157b519a2453ebc40421c65a5fb6b6cf3a99da37bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"47f2d0dad0904e4754a31b56bc3996015000d246a651cd7ae8a0c11a13c46d29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7e1eb9dec290fe93db72581dd65bd5fd27cc167d1e8123fc32d61e49b3882af0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"16ce1f8437f72a646ef479dfa8d9081aab6a8d15639d9a41302d1dcaeb83d480\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8a9aa2912542895fd0b2c1620fbbff56d6354a0244b869584a9421322d58549a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"3dcd0c3947e33253b1421b74217847eed8f5dad1afe3feda1a3f46868bb89d5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"65ca4d1635580c50567fead06bf8ddc00121f26e3c1b0af3588da26caa4031e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"d08fc10d786223e68c46b2831514aa962b8e810b48bce7c290fd5a9dc946e0c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4652f8a2150a4931901a27c005b2bb44d4d7d1212b652ba25bff4887be9a061d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"afe3e4fd6498dd752c1408d44d697c78067d9cfca49b8e17c957f1107bd29159\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7b5707c55f4a831b6c40c8de714355dc37f0769f3d01e3ab63089a574a5e90c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"c60828ca16ef84b7a5f682d52ef03cede85f017663e62fb9fbc0ad772dfd2ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b80f6cef2e969c1f008570634a903912fbb963e02b61fcd3d6eabc96e4d7e660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"ec22cae50a0d141359a788b23404a1b87020873e849f1c7f2821e4f4f589819f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8011907f4913a9f005064fa089a9485c460a80b7297b4e7706c2794bced53adb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"ea3f4ea4acf30bd44f150de33dd1c53f56bd31e718ea55da79b359501ae332ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"87ebeaa6eb266e52a2aeeffb20a6bfec05537473569fb827a1c21b7f4278a033\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fa7d0d6f93c4fe7b3a94fcb94afd6da2ab83b0ea6d135aa71da22c34993718e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"37cdaebbb9459c785c9575c5ac0f286daad6ed4c5aed53dddcc7bc477a218575\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c37f853416f0a9352736127603b1f84bc1be9730f83da4fc8da4e0aedf2c07e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"aab6da24089d86ef6744750ec37e3ae4ae54a659206c3db678eda83f7331c625\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e7cdfdfbf54424223419f523f1a4eb07195319bff0df2592a923437be7e0ddf9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d42d6ef898b5bb2f53c8be14ffeee02d873488450136c9cde9672f67f8b5db65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f2d1aaf5\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4cd0a27dccaee571\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-simulator-w2-58b06e\"]}],\"name\":\"c256fd8bd371bcd3200dceaa60a34fd91fbe5b36d1fd2ec991ebc2490e9630a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7511c9e343a4a77a350a8f490a05d514a7fb3a7c49cba5959a484dff97a8d826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"bdd2a7ea22d1e652493a5199df68b6469e1d56e9f4cecd5730da55663f4ae048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"66c1d0d7977e242c1ab5ab2e30c9e5d38016fdb4efbc086cfe61f11b43028d1f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-58b06e"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:40.450Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182#rule-1"},"creationTimestamp":"2026-11-04T00:34:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:39:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:39:15Z"}],"name":"5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a","namespace":"kuadrant-system","resourceVersion":"78912","uid":"02f87b13-9068-42fd-98f6-6e99a2354cfc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-697182.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:34:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:40.520Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/75f54bc5353c4d3063f1466e62a6e65e82a52c69fb2970273309c4b07570e244","error":"authconfigs.authorino.kuadrant.io \"75f54bc5353c4d3063f1466e62a6e65e82a52c69fb2970273309c4b07570e244\" not found"}
{"level":"error","ts":"2026-11-04T00:41:40.577Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b3d975a4971c2a9ae72f2a8ef8333eb45d4713d6277b59c26ef80d6bb2be42a9","error":"authconfigs.authorino.kuadrant.io \"b3d975a4971c2a9ae72f2a8ef8333eb45d4713d6277b59c26ef80d6bb2be42a9\" not found"}
{"level":"error","ts":"2026-11-04T00:41:40.588Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-de0ea2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"6e7eb8f6-4c81-49df-885a-1cfd92034b41\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:02Z"}],"name":"kuadrant-e2e-worker-w4-de0ea2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-de0ea2","uid":"6e7eb8f6-4c81-49df-885a-1cfd92034b41"}],"resourceVersion":"82148","uid":"ad417c34-a43f-49c3-8386-dfcd19d97287"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"8f41f5d27f92196508ddee2fc47e51daf5af5c4825a7e8591ede0800be949fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7a4e12ba594de064264e5a79bafadfb910f6fe0c5c088cc1d86aa478feff909\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"545e35b30c59a1aa62ea994b7a5be31f8d3760ca10aeb1ba456d4eea87cf7a6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"a4133ad72b872fc03206a842894304ad17b775369b97a617c5b595bdc943e826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"771078d889ef85b81946eff0b2ff32fbabcda38cbb208fa37bb96509f7d979a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"bba5991046822f1b6e0758327a2491b9658a798d2b607b2a7144f024f0067676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6d451581ca6171a655cb504496641e173bb76b72741c6c02eaed94083a536735\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"46cfece21c467f625b03ba5a104af0b1e8d4a213c5695ef30a112544f1c16cbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9d157bb2d1741f38e7e5854412ecaf7c47f4b489927c97cca666d33d1bb4d834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"a6089be44340b73e309196db9a8c89f042bf2d2570f1e88b8378d364827acdbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d186d8e5e42a867e2a08face337b9772aeae6ba493c896ca867692f02c4456e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"8d1e7b487515ecba92117549552071598f9233e149b32fc4eb13567225116a07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"68a9c4eb18e71677a594352b1b7ad0325a4c685212ace060db3b90da668c6f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"5cd2749f5fa499321c3a48c9e432951a046807348668fc35fed27b72ac6db3cf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9d55be3daa24118dde3ad2d28e0c6b48c00dd4df682a4745fb2c1e69a0bb735c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d5d96025b93f14012073fc9c61dbf91db95fa9ca2b726ddb91f601e538620862\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"06e46d8eb2da8005de0d157a8845a587567d7612ef6f79fc810ddaf2f78d6bb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"66272d32af643987684100422c0268e207c651a098012b0f2f6c77f68bc6d25f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"84d595c1af2ff8ed9ca0194212a4eeb97f3de15fbf7e225e4c6eb56d5a39f8e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"c13145cd6f1056971233d0e758c11ce8cee133a64eb3cf6a02b122d5a29a71a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"31e47065c52fb96c2470ed21a3d45c533ef5c080afe214081ff5637fa2b0d420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1b9a9d0030ed877e95dea36c3d55d7589cb8b6b826be9455de9bcdccb31c4a39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7db200bfe44cc9433850257d064b4edb5240dd6951e2251e271d79ce2599c45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"042db8e6145979020b4aa2ccc468918dcb1f32d03a1880a86a855cf8560eb16f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"5c91323526e4e1197474b1874d1ec0a636c457a84e2013e3688214b3c9f40292\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"56ff390a2f15a60052acfb6c577c0d99916ec6f8ec0c500a95983e8cd3ea840a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"26bea37b48ab2ee00f259c3b8c9bc4c47b26a86a798c02dc31f2843e47829ca7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"19013eb61834602135d4d3c8ffee368d3060b9b63fc5f9bf0951d431b8c38fdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"3b814cb972103fb740b36a5d13d0e90ab61a2243933f933f775c42677c1a5d85\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e7c8f0c364705957418c58fc49a204d16bc88650633ba572edfd632ab77f5666\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"91cab405f0636396c7771c6dc75f806c2ca022fb0848ae3c2fcbb33e22a339ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"67532e0078356f799dfcf346f3e77095d0c624d2d10cdeaa6e88f469fbb87049\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1b04bb6432aa7ede0fec0fc20a68d9446f453e5c05a3adfd45bf17a6f8b9ebc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d0d9929f02171b1ab4c86941d9f44cb58b54eeb19d2f221229eb30f01bcf7375\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"566ec84294cde50603c3dfa36bdf2a31651f5466d00e709b76f896a26cdc6f50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6bf0b16aa8962b07d84f7048f7b90a0b18983bd80e9edb53eef17bed17344e99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"12b5dd9ded539680a4677101fbb814ed65f93d791dfecc06a4e34ac1ca666285\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3feb12b2847f536be51d0b1e92294157bff9383e20f2265f92e3ea76cb048d9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"9b267730031d7c70062f248c5d4811c04b382ca0287062b64928d46b92989d20\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"fd11e09603fe10b92e5b13701b94b1bc51bd77fefaef648e1161701b5fa58e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"68bd4c49aaa83b70448e00df2203ce7ce94bfe9c263e924f642ee7ca2732c5e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"f72767414d30bcfd4e1eb5788ae3b97e09949d30d08ca78756af19a21889315d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"685672fdf62a49b437cb02b0a5cf31117061b1cb305120627a24d822b87448b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"28b61973b7f554ada23df8f2adbcef9c3140a267f58ebf2ee8fb91ca7b72c4a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dac478a38580f45da71c649418701234a58fe64e526cb6afb7481ba444836b2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"36b0f5aa2c414392caa7ffd3bb635d11e950c904103befcfeb425d09f5b9dd48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"90c38ac2efd8fc638edcb5f7c8693ef7a3280fbb60b050b3849a607a39eaf69d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"03f1f356a7d76e767be8c0f275a64f6b98f09a8f3d04640561ef4c3f580d2783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"4402031351082e527488b2a5cccf7d68722dece1fa01370d5c21333ca6505522\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"b9c11f37fe72e97b7a55dae48d999a758e39f367ad7a116d7c28ae2380778fe1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"1fae005cfbffbe4e3aaf50dbb8dd3b5a9f584045e1475c7738a315467ec67d5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"135dd5eacaaaeb159be4c9871fe73af3bfd928f5de1be32e147f296965866b96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"336d069594861bb5e759f874cb7b2f97e4c07a0dcd6170a429970f5f2d53ac0b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"dfc32b1869457c56bed8d097b7c0a22a2a0b12e527f2acb8733ab9067d057c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e25322c24d98be7252f7c79cda0327987ee6ee4733d332ed5901e1b273397c89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"00bc5328f6973fb2115cb694774124ef334eba1a1cfc7badbab358850a407a44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"1f9f53047b22c1c17c09acdb0fd9c17eb0638398ecc1a9a37a86b01d811cccb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"96d4f3037b42b8b4dbb2b4c60ec972ab8af4ae9746f33d3238fb10f28f178b9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"310e1acfd0057c6e83529a4c7d8365e210e81104c28ddd0e12bf7c27c4f96a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"78c96b65770748aed921a19b6a2bd36cc8321c0a7dec5651a52e25bab7ad2164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dfcdd2ad233477f91e46e790091a8a25cccde3e540e5dfee8a882e70548b396d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"32a037705f978b303327717e1c0ec5e2335c0b26c10797f521b5135cf6a2453a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e6a99dc788b835aacddb6627c89f73143a475188279769039fa67efd06d375ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9960c39f056ac6bfdf36a15fd9c1fa7c853b27ad278ebc44f7ec6e94d68172d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"7287734b84ceef6341393a90e3ed4982016519f2ef7f9218e0807c5b41fe5f8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"45872a4dc74f3d9c8887e6e6522fcc3828da98c8175226158ad7d1e0d3a30127\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"688f84a7dff8577d0e7ac9a7d4ec36ff7dbdda50d779bc6b57d6aae8ce8b2fa7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"435ffa54404a9fbb884e542d138a68cfb6613f929fac5c1d075c32a78366f2c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"41543e9b40d595358566e7bb5bcbb2fccbbbe2135adcd30f456cbd888d802a5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"4aa7d5ab26c862da3f59d51848309ebfd14dd317c39eeefa3ea8a80838fbb716\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"80cec2e610c1806df05551724b800f012f0c084c1813547c1bbd670985b653f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"74df5489e7dfa47ee79eee83e342918f6531e925cfe1a798956b35da601d884d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"ceac94fca2ae9ea5cc47f3df0ec9d6a10b6251c722a213562fa646ea167dcdce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e619c29e635edd15be7867ccd71c115af280811a435be9acf9042fe6ce2369a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"836cd1aaeda4d6b267aa83969a7f76f361d3884106e3fe9a1a411ebc103c733b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"58317c757c8a458d1a8d6d5b7d8a3528d73c19d945347d61d3167c58a9f2abf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"811ca47fdaa1feef5760290388150e142b3763ef459a60d86cb3e223c6af9a2e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"484761bfa30c42040a68a552fd37e9c6794f6d1979ee07beb44e5d6b81c5f2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__9c9cff66\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"bb9abe38af5605a2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-simulator-w4-de0ea2\"]}],\"name\":\"c98397041d5e3535484e38692edcddb66bc94af55a8aefe7b372827b5b9a3658\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"df7b3104a100478ba86ef3efa2a83b687d49ec85b07c62e635a293b710028281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3fe8aaa75098b89c44ca3fe5a5cfc62dfa76bcc518cd59e8843f2e901b0a131d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"cfa45a246c21e687ad88a5b47e3484a2e94f500826f168a1b20a49a1094bc73c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-de0ea2"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:40.632Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443","error":"authconfigs.authorino.kuadrant.io \"f506c79f8fd8ecfee36a33e832934adb6395e4d7b77aa7717d82715687979443\" not found"}
{"level":"error","ts":"2026-11-04T00:41:40.686Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6f1c8865631e08e6865222cf7c67b4f1e4fd3ef2e73aeedfeaafb0c62e922b30","error":"authconfigs.authorino.kuadrant.io \"6f1c8865631e08e6865222cf7c67b4f1e4fd3ef2e73aeedfeaafb0c62e922b30\" not found"}
{"level":"error","ts":"2026-11-04T00:41:40.741Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/57a651d432e82fcb452972cb89bc08d73dfd5300a2be005e0d3c1b5abb3bc08c","error":"authconfigs.authorino.kuadrant.io \"57a651d432e82fcb452972cb89bc08d73dfd5300a2be005e0d3c1b5abb3bc08c\" not found"}
{"level":"error","ts":"2026-11-04T00:41:40.795Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ab0362982f33cf77e74bafb2ddf9b7b023e89e5427ad977283f4c41524814757","error":"authconfigs.authorino.kuadrant.io \"ab0362982f33cf77e74bafb2ddf9b7b023e89e5427ad977283f4c41524814757\" not found"}
{"level":"error","ts":"2026-11-04T00:41:40.849Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bb97d028680959de1290dbad1bdf5bfd2fd46c3dfd3f71a36e19ee29845fc15c","error":"authconfigs.authorino.kuadrant.io \"bb97d028680959de1290dbad1bdf5bfd2fd46c3dfd3f71a36e19ee29845fc15c\" not found"}
{"level":"error","ts":"2026-11-04T00:41:40.907Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/de6b376cdc353e536e687400afde64f53961d19e663d39be688a0737a2b2680e","error":"authconfigs.authorino.kuadrant.io \"de6b376cdc353e536e687400afde64f53961d19e663d39be688a0737a2b2680e\" not found"}
{"level":"error","ts":"2026-11-04T00:41:40.962Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b26ce7ea2624e68545c0350ffa608ca4d5c967ac75f46f6f9faeb8f7ea009a95","error":"authconfigs.authorino.kuadrant.io \"b26ce7ea2624e68545c0350ffa608ca4d5c967ac75f46f6f9faeb8f7ea009a95\" not found"}
{"level":"error","ts":"2026-11-04T00:41:41.016Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/43306fa4e8b92dcb3c9720febb98eeb170e90451da6e6bfc50d8a2bb9aa464ae","error":"authconfigs.authorino.kuadrant.io \"43306fa4e8b92dcb3c9720febb98eeb170e90451da6e6bfc50d8a2bb9aa464ae\" not found"}
{"level":"error","ts":"2026-11-04T00:41:41.066Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-697182","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:34:06Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bd9a6cb4-b62e-417b-b7c7-1a492d09cb48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:40:35Z"}],"name":"kuadrant-e2e-praxis-a-697182","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-697182","uid":"bd9a6cb4-b62e-417b-b7c7-1a492d09cb48"}],"resourceVersion":"81086","uid":"373bb61b-a5f5-4bca-9293-56d39b2b5572"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"032c8d8d097aaa749b90d9d6274e3867531eb2c3ab84b7ca0fe579f8dd776e5d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"7f3a401d8131376569e6a438b7f803983a4721ed1f445b54ed578c76147214f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"19f1936177f8c2f0b172e90ca40e38f76764f58e7a58bccda05b45faf262e045\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"02289e54f3ea560652a8103a88149998efaa5003921b720ebb86c74779062ed0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"3fcc5c80e34a83cbdd185016eed94a9b8625c8bc74eb4328e6b2a9aeb397f54c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"431a305c8904de818aeaac387c5267630c7d7b25241f3ccc769c77c42015d200\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-697182"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-697182\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:41.070Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4f933df876ef27cca7c9f4a691245ca2066499cf89096da05f770a45bc8aee35","error":"authconfigs.authorino.kuadrant.io \"4f933df876ef27cca7c9f4a691245ca2066499cf89096da05f770a45bc8aee35\" not found"}
{"level":"error","ts":"2026-11-04T00:41:41.127Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1798d55057b6d0cca6f9abd70585585f923cf50541f4ea327da38c6cbbb73344","error":"authconfigs.authorino.kuadrant.io \"1798d55057b6d0cca6f9abd70585585f923cf50541f4ea327da38c6cbbb73344\" not found"}
{"level":"error","ts":"2026-11-04T00:41:41.535Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:41.609Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-697182-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-697182-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:42.086Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-697182","namespace":"openshift-ingress","uid":"6d72df5a-d41e-49f5-ab27-bced33417c60","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-697182\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:41:42.390Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:42.390Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:41:42.489Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-58b06e-kserve-route","namespace":"e2e-models-e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w2-58b06e-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:42.589Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w4-de0ea2-kserve-route","namespace":"e2e-models-e2e-worker-w4-de0ea2","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w4-de0ea2-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:42.717Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-a4fac5","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:42.844Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w2-58b06e-kserve-route","namespace":"e2e-models-e2e-worker-w2-58b06e","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w2-58b06e-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:41:43.038Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-22de5b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-22de5b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:41:43Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","reconcileID":"b765138e-621f-42ed-99f4-08ca75143aa2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:41:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:41:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:41:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:41:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:41:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:41:43Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","reconcileID":"4aadfe90-0af7-4f07-92ea-b3709c306c0f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:41:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:41:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:41:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:41:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:41:44Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:41:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:41:44Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","reconcileID":"e0592955-257a-4f08-b94d-9e2cd7637e61","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:41:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:41:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:41:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:41:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:41:45Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:41:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:41:50.006Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","HTTPRoute","TokenRateLimitPolicy","AuthConfig","Gateway","EnvoyFilter","ConfigMap","Limitador","Kuadrant"],"eventTypes":{"create":7,"delete":12,"update":20}}
{"level":"info","ts":"2026-11-04T00:41:50.359Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:50.365Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:52.738Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:41:52.860Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:52.861Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:41:52.861Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:52.944Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:41:55.747Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:41:55.749Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:55.756Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:41:55.814Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:41:55.816Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:55.816Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:41:55.899Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:41:55.899Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:41:58.329Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:41:58.329Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:06.346Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","Gateway","HTTPRoute","Limitador","TokenRateLimitPolicy","AuthPolicy","ConfigMap"],"eventTypes":{"create":18,"update":11}}
{"level":"info","ts":"2026-11-04T00:42:06.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:08.858Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:42:08.957Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:42:08.957Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:11Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","reconcileID":"19370852-19e8-4396-ad12-a021dbe50af0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:42:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:42:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:42:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:42:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:42:12Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:42:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:42:12Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","reconcileID":"ace921dc-825c-4d58-92b5-7feed2e39130","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:42:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:42:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:42:12.776Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:42:12.786Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:12.786Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:12.813Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:12.818Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:42:12.828Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:42:12.894Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","reconcileID":"4edd8d71-3586-410f-b0a8-97948e1e60f3","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:42:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:42:15.305Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:15.305Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:42:15.365Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-ad3cbc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:42:20Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-238db1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-238db1","reconcileID":"35b4c5d0-7731-4017-91d6-d1846a2b2b5f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w2-238db1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:42:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-238db1","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:42:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-238db1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-238db1","reconcileID":"9fef6de5-8b3e-4d3d-97d7-6c15fa3a03c6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w2-238db1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-238db1","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:42:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:42:26.315Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Kuadrant","Gateway","TokenRateLimitPolicy","HTTPRoute","Limitador"],"eventTypes":{"create":3,"update":8}}
{"level":"info","ts":"2026-11-04T00:42:26.609Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:26.617Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:28.655Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:29.458Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:42:29.553Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:42:29.554Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:42:29.554Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:32.505Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:32.495Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:42:32.516Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:32.516Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:32.516Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:42:32.518Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:42:32.619Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:42:32.619Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:35.433Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:35.433Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:36.824Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","HTTPRoute","Gateway","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-04T00:42:37.044Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:37.058Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:40.316Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:40.317Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:42:40.355Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:42:40.527Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:42:40.527Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:42:43.672Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:42:43.675Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:43.685Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:42:43.687Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:42:43.709Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:43.709Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:42:43.817Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:42:43.817Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:42:43.817Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-238db1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-238db1","uid":"a871959e-14fe-46d3-b8f2-00d3bcc71d04"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-238db1"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-w2-238db1\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:43.818Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-238db1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-238db1","uid":"a871959e-14fe-46d3-b8f2-00d3bcc71d04"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-238db1"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-w2-238db1\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:43.819Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"449ca852af47a1b5a00efc7a8325cd4c05b2d460e01b696fcc011d14e0dab138","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["449ca852af47a1b5a00efc7a8325cd4c05b2d460e01b696fcc011d14e0dab138"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"449ca852af47a1b5a00efc7a8325cd4c05b2d460e01b696fcc011d14e0dab138\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:43.924Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-ad3cbc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-ad3cbc","uid":"76771efd-f8cb-4c36-a180-ec37c18f7a04"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-ad3cbc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-w4-ad3cbc\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:43.960Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-ad3cbc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-ad3cbc","uid":"76771efd-f8cb-4c36-a180-ec37c18f7a04"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-ad3cbc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-w4-ad3cbc\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.013Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"63d30fa15f0c2b6c6f5fb22c3e04535e150fe07e2a1261ed59945ab2a4689711","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["63d30fa15f0c2b6c6f5fb22c3e04535e150fe07e2a1261ed59945ab2a4689711"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"63d30fa15f0c2b6c6f5fb22c3e04535e150fe07e2a1261ed59945ab2a4689711\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.115Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.187Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a68a00fbe4ede3c0b38fe9870b558dc6cca1ac15f393e533ce225212342e5576","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a68a00fbe4ede3c0b38fe9870b558dc6cca1ac15f393e533ce225212342e5576"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a68a00fbe4ede3c0b38fe9870b558dc6cca1ac15f393e533ce225212342e5576\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.261Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.341Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-238db1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-238db1","uid":"a871959e-14fe-46d3-b8f2-00d3bcc71d04"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a00fbe4ede3c0b38fe9870b558dc6cca1ac15f393e533ce225212342e5576\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"7130a2cd01d2c1a8eecf067d885e4657ef312b3d7f30b5e4eac4739658bad541\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"31f0143a60e13ea6745e7fb61bde4910bfe6acd14bb292dc0539b5f33d751f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"d45b1d00670fab41fe4c23d7fbdb9884306dde94843215fbbfd65a3cdb95fbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b289e3f1befd913bc5c27df0099b83939379105282e4bf360d74f9846054df84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"9039dde6e4107ae3eba9b18e0b483eff317c0a81f9dbd120da663535aa39f3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11c6d0a651652f81b1b93abb5a792126b56c88e30da1b18d815362f7b0ce56cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"8c0d0766432c32f4d1cb9cc2e54ca90e3333e0f672a08ec2e6034557027a73d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"449ca852af47a1b5a00efc7a8325cd4c05b2d460e01b696fcc011d14e0dab138\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"a57315f66093f4812f37dc0bf446d25423c0602dcdcc77576c94ee00e028b707\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63d30fa15f0c2b6c6f5fb22c3e04535e150fe07e2a1261ed59945ab2a4689711\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"91f6dc455b873524b4e6dd78ce85bc6951242eecb740adc87c5d8fc271c787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-238db1"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w2-238db1\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.342Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.414Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.492Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b289e3f1befd913bc5c27df0099b83939379105282e4bf360d74f9846054df84","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b289e3f1befd913bc5c27df0099b83939379105282e4bf360d74f9846054df84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b289e3f1befd913bc5c27df0099b83939379105282e4bf360d74f9846054df84\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.521Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-ad3cbc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-ad3cbc","uid":"76771efd-f8cb-4c36-a180-ec37c18f7a04"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"9bf97f063f975f92080a902131d0daa53318e53d91b57013cbc27123f26504c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"5dedc6dee45d1abee8c19f6f4c42fb55d06758b5fed0909cf21751bdfe9be5f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"980887992cc7e6c74980cf1fe4e50f09c0f06a300c9323cb555f8f0c45740837\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"92fc99421f6a2bb91b311a13d2db9c621790c803fde132892e7873aa4bc3675c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"967c3cc0acbbd5cbf744b398accf5c5e3d0d0e23659fc20e69ddc0bb3f0a8d96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"92303fb39cb3b4f32df939e72e4c266d891b1f7daac1e5e5697090cfdc30cc3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-ad3cbc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-ad3cbc\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.574Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.651Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"31f0143a60e13ea6745e7fb61bde4910bfe6acd14bb292dc0539b5f33d751f96","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["31f0143a60e13ea6745e7fb61bde4910bfe6acd14bb292dc0539b5f33d751f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"31f0143a60e13ea6745e7fb61bde4910bfe6acd14bb292dc0539b5f33d751f96\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.732Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"11c6d0a651652f81b1b93abb5a792126b56c88e30da1b18d815362f7b0ce56cb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["11c6d0a651652f81b1b93abb5a792126b56c88e30da1b18d815362f7b0ce56cb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"11c6d0a651652f81b1b93abb5a792126b56c88e30da1b18d815362f7b0ce56cb\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:44.808Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387\" already exists"}
{"level":"error","ts":"2026-11-04T00:42:45.261Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-ad3cbc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-ad3cbc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:42:45.418Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:42:45.813Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-238db1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-238db1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:42:46.622Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:42:46.623Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:46.623Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:42:46.722Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-w2-238db1","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:42:46.832Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-w4-ad3cbc","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:42:47.481Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-238db1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:42:47.611Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-ad3cbc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:42:54.880Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","AuthConfig","AuthPolicy","HTTPRoute","Gateway","ConfigMap","Limitador"],"eventTypes":{"create":20,"update":10}}
{"level":"info","ts":"2026-11-04T00:42:55.141Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:42:57.144Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:42:57.320Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:42:57.320Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:00.137Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:43:00.146Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:00.146Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:00.151Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:00.164Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:43:00.168Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:43:00.356Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:02.944Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:02.944Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","reconcileID":"6b7ab7ea-038d-42c5-8be9-8ae2b63a34a6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","reconcileID":"6b7ab7ea-038d-42c5-8be9-8ae2b63a34a6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-697182","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-697182","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-697182\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:43:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:43:15.417Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","AuthPolicy","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-11-04T00:43:15.731Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:18.034Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:43:18.233Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:43:18.233Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:22.046Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:43:22.056Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:22.056Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:22.057Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:43:22.113Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:22.119Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:43:22.119Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:43:23.306Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-697182","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:34:06Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bd9a6cb4-b62e-417b-b7c7-1a492d09cb48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:32Z"}],"name":"kuadrant-e2e-praxis-a-697182","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-697182","uid":"bd9a6cb4-b62e-417b-b7c7-1a492d09cb48"}],"resourceVersion":"83277","uid":"373bb61b-a5f5-4bca-9293-56d39b2b5572"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"032c8d8d097aaa749b90d9d6274e3867531eb2c3ab84b7ca0fe579f8dd776e5d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"7f3a401d8131376569e6a438b7f803983a4721ed1f445b54ed578c76147214f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"19f1936177f8c2f0b172e90ca40e38f76764f58e7a58bccda05b45faf262e045\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"02289e54f3ea560652a8103a88149998efaa5003921b720ebb86c74779062ed0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"3fcc5c80e34a83cbdd185016eed94a9b8625c8bc74eb4328e6b2a9aeb397f54c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"431a305c8904de818aeaac387c5267630c7d7b25241f3ccc769c77c42015d200\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-697182"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-697182\" not found"}
{"level":"error","ts":"2026-11-04T00:43:23.843Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-697182-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-a-697182-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:43:24.120Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-697182","namespace":"openshift-ingress","uid":"6d72df5a-d41e-49f5-ab27-bced33417c60","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-697182\" not found"}
{"level":"info","ts":"2026-11-04T00:43:25.062Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:25.062Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:43:25.467Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-697182","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-697182\" not found"}
{"level":"info","ts":"2026-11-04T00:43:26.602Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-04T00:43:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","reconcileID":"04255c6b-8437-445e-bcb9-7ddbe0b748f6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:43:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","reconcileID":"f2804604-1137-4dea-8c2c-6aaa5b24c4ee","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","reconcileID":"f2804604-1137-4dea-8c2c-6aaa5b24c4ee"}
{"level":"error","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","reconcileID":"f2804604-1137-4dea-8c2c-6aaa5b24c4ee","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","reconcileID":"ede53c6e-15a2-4abe-bf07-34308d10fa65","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:43:31.919Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:43:31.931Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:31.931Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:31.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:31.941Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:43:31.941Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:31.955Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:43:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:43:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:43:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:43:32Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:43:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:43:33.005Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-697182","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:34:06Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bd9a6cb4-b62e-417b-b7c7-1a492d09cb48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:32Z"}],"name":"kuadrant-e2e-praxis-a-697182","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-697182","uid":"bd9a6cb4-b62e-417b-b7c7-1a492d09cb48"}],"resourceVersion":"83277","uid":"373bb61b-a5f5-4bca-9293-56d39b2b5572"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"032c8d8d097aaa749b90d9d6274e3867531eb2c3ab84b7ca0fe579f8dd776e5d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"7f3a401d8131376569e6a438b7f803983a4721ed1f445b54ed578c76147214f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"19f1936177f8c2f0b172e90ca40e38f76764f58e7a58bccda05b45faf262e045\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"02289e54f3ea560652a8103a88149998efaa5003921b720ebb86c74779062ed0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"3fcc5c80e34a83cbdd185016eed94a9b8625c8bc74eb4328e6b2a9aeb397f54c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-697182-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__fcac3495\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-697182\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-697182\"]}],\"name\":\"431a305c8904de818aeaac387c5267630c7d7b25241f3ccc769c77c42015d200\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-697182"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-697182\" not found"}
{"level":"error","ts":"2026-11-04T00:43:33.289Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:33.349Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:33.408Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:33.527Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:33.650Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:33.706Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-697182","namespace":"openshift-ingress","uid":"6d72df5a-d41e-49f5-ab27-bced33417c60","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-697182\" not found"}
{"level":"error","ts":"2026-11-04T00:43:33.765Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:33.824Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:33.944Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:33.972Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-697182-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-a-697182-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:43:34.003Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:34.062Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:34.120Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:34.301Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:34.360Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:34.419Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-4cef7f","namespace":"openshift-ingress","uid":"9e46bde5-666e-4f03-9164-7868a756653e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-4cef7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:34.478Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-22de5b","namespace":"openshift-ingress","uid":"0c78d756-7ed6-4141-bd67-6342de6f21d2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-22de5b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:34.539Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:34.598Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:43:34.660Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:34.660Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:43:34.877Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-697182","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-697182\" not found"}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","reconcileID":"130207b1-5b0d-4edf-9524-f2b3429d71c6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:43:35.331Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:43:35.393Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-4cef7f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-4cef7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","reconcileID":"130207b1-5b0d-4edf-9524-f2b3429d71c6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-4cef7f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-4cef7f","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-4cef7f\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:43:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:43:46.022Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","Kuadrant","Limitador","HTTPRoute","AuthPolicy","ConfigMap","EnvoyFilter"],"eventTypes":{"create":4,"delete":9,"update":21}}
{"level":"info","ts":"2026-11-04T00:43:46.323Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:46.343Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:48.660Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:48.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:43:49.031Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:43:49.031Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:49.215Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:43:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","reconcileID":"52ce4f2c-cb3f-4220-b280-5765888a526e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:43:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:43:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:43:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:43:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:43:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","reconcileID":"2c563054-66cb-4e75-8b93-cd8c68e67a84","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:51Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","reconcileID":"2c563054-66cb-4e75-8b93-cd8c68e67a84"}
{"level":"error","ts":"2026-11-04T00:43:51Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","reconcileID":"2c563054-66cb-4e75-8b93-cd8c68e67a84","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-1c754c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:43:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","reconcileID":"6aee5a0f-c3e2-4757-bc94-dc849c11a108","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:43:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:43:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:43:52.255Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:43:52.257Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:52.317Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:43:52.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:52.326Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:43:52.326Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:43:52.480Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:43:52.481Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-b-4cef7f","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-b-4cef7f\" not found"}
{"level":"error","ts":"2026-11-04T00:43:52.481Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-b-4cef7f","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-4cef7f\" not found"}
{"level":"info","ts":"2026-11-04T00:43:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:43:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:43:52Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:43:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:43:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:43:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:43:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:43:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:43:53Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:43:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:43:54.791Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:43:55.240Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:43:55.240Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:43:55.748Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-1c754c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-1c754c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:43:56.906Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy"],"eventTypes":{"delete":2}}
{"level":"info","ts":"2026-11-04T00:44:02.436Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:44:02.465Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:44:02.465Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:02.466Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:02.466Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:44:02.530Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-e89576","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-e89576","uid":"921550b9-e248-45c0-b3dd-b3c75826bf69"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-e89576"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w3-e89576\" already exists"}
{"level":"info","ts":"2026-11-04T00:44:02.530Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:44:02.530Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-e89576","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-e89576","uid":"921550b9-e248-45c0-b3dd-b3c75826bf69"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-e89576"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w3-e89576\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:02.627Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-b-4cef7f","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-b-4cef7f\" not found"}
{"level":"error","ts":"2026-11-04T00:44:02.627Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-b-4cef7f","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-4cef7f\" not found"}
{"level":"error","ts":"2026-11-04T00:44:02.627Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:44:02.627Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:44:02.671Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:02.796Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:02.887Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:02.959Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:03.037Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:03.045Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-e89576","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-e89576","uid":"921550b9-e248-45c0-b3dd-b3c75826bf69"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"3ea848ea7a28ccec66fa770b3af2452b6b0b907146017230150b4eb245cdf478\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cbb2bfaa3f7807da810e5291128dafdf0ad6a95e35e1e8579ba5c146fe1b92b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"755a0cc7a588e772af9132fcda445bc892a59b574f2f7284b043f1d478444943\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cfbf9c267cd9cb7b63a74fd1748936a93876c7424601b821496ba7463c22e3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5b4bf640448cf71b6adb08f5416cb2f93badffbd5e65a485b88a5db0cb08b40c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"493cb8642d7cbb23499392f14e4d28be76ed3e633c56318221b47ff22efa9714\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-e89576"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-e89576\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:03.108Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:03.167Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/744d9e4b7b1234bf41df3e2c9a677909ac2908affb49bbfac1a776f5ae8aefd0","error":"authconfigs.authorino.kuadrant.io \"744d9e4b7b1234bf41df3e2c9a677909ac2908affb49bbfac1a776f5ae8aefd0\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.222Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/438aab120f6f610485cdf4cc218703bc6ef09935bf47a5dcbc576bd2507871f0","error":"authconfigs.authorino.kuadrant.io \"438aab120f6f610485cdf4cc218703bc6ef09935bf47a5dcbc576bd2507871f0\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ffaf78c0911c0cce818a05e9d8899131bc09ba9ffcd91f384698d15b50a0fe6d","error":"authconfigs.authorino.kuadrant.io \"ffaf78c0911c0cce818a05e9d8899131bc09ba9ffcd91f384698d15b50a0fe6d\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.331Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/edb245b1b63430abaa79db8793555a1b4f94c1732f59d6e3e9a24bc959437794","error":"authconfigs.authorino.kuadrant.io \"edb245b1b63430abaa79db8793555a1b4f94c1732f59d6e3e9a24bc959437794\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.385Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8","error":"authconfigs.authorino.kuadrant.io \"a2c6543b5da230d44eb3cd40792efd647109f7188729d6ecfe5077ce482d78f8\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.440Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989","error":"authconfigs.authorino.kuadrant.io \"0df4f2578a62d8eca6accade23a4d03885cd61bcbb85542218cb718a8d17b989\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.495Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f2a3314e7ff8575da75b1c7fb536efb2a98189c1d7a58e254bfb3659a9758ad6","error":"authconfigs.authorino.kuadrant.io \"f2a3314e7ff8575da75b1c7fb536efb2a98189c1d7a58e254bfb3659a9758ad6\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.549Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b","error":"authconfigs.authorino.kuadrant.io \"554b913710d69eaf5e4a93dce5612fb68133aac192e1bb087ac4a1cdc5264d8b\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.605Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2eaf26f1ab6d64b6debb6b919567b01da727f535d4bdd82b3513bceae12347b6","error":"authconfigs.authorino.kuadrant.io \"2eaf26f1ab6d64b6debb6b919567b01da727f535d4bdd82b3513bceae12347b6\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.660Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4","error":"authconfigs.authorino.kuadrant.io \"8ac25dbca36d0747c80cbc5b3d81e9baece03b2b7b6d01943a919b0117f996a4\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.716Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338","error":"authconfigs.authorino.kuadrant.io \"920f0ee320241a81a9089b62af69748b73a343f000d536bb5e61023951e9b338\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.771Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a","error":"authconfigs.authorino.kuadrant.io \"5cad5a9a49a95fa135925ed3c8bfe36bfd02236353cb8a4ee9d53774af14582a\" not found"}
{"level":"error","ts":"2026-11-04T00:44:03.853Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:03.913Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:03.972Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.096Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.155Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.279Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.284Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-e89576-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-e89576-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.338Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.397Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.455Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.582Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.641Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.760Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.822Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.884Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:04.943Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:05.127Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:05.188Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-22de5b","namespace":"openshift-ingress","uid":"0c78d756-7ed6-4141-bd67-6342de6f21d2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-22de5b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:44:05.188Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:05.188Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:44:05.513Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-w3-e89576","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:05.695Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:06.147Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-1c754c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-1c754c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:44:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","reconcileID":"9b9c2807-aabe-4eb6-bb7e-6cd931f52e96","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:44:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:44:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:44:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:44:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:44:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:44:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","reconcileID":"ab5e1829-6c37-4e10-86dc-3a7ca35adad7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:44:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:44:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:44:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:44:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:44:14Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:44:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:44:14Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","reconcileID":"57e2af2d-0c88-4513-8abc-e4bd50c0fe82","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:44:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:44:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:44:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:44:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:44:15Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:44:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:44:16.625Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","HTTPRoute","EnvoyFilter","AuthPolicy","AuthConfig","Gateway","Kuadrant","Limitador"],"eventTypes":{"create":12,"delete":15,"update":24}}
{"level":"info","ts":"2026-11-04T00:44:16.763Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:16.772Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:19.233Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:44:19.516Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:44:19.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:44:19.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:44:19.752Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:44:22.962Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:44:22.968Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:22.972Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:22.972Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:44:22.974Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:44:22.975Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:44:23.079Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:44:23.079Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:44:25.947Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:44:26.260Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:26.260Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:44:27.679Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","Kuadrant","HTTPRoute","Gateway"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-04T00:44:27.832Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:27.846Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:31.056Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:44:31.232Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:44:31.314Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:44:31.314Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:44:31.761Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:44:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-516871","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-516871","reconcileID":"53340c70-9741-43aa-8c53-f07ec8f44f32","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w2-516871","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:44:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-516871","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:44:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:44:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:44:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:44:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:44:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-516871","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-516871","reconcileID":"e3f95c42-3778-43a5-ab52-f10983591b1e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w2-516871","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:44:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-516871","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:44:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:44:35Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:44:35Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:44:35Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:44:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:44:35.137Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:44:35.140Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:35.146Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:44:35.147Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:44:35.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:35.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:44:35.199Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-1c754c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-praxis-b-1c754c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-1c754c","uid":"00f7755d-f779-4d65-81de-2869b7207695"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-1c754c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-1c754c\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.215Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-1c754c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-praxis-b-1c754c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-1c754c","uid":"00f7755d-f779-4d65-81de-2869b7207695"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-1c754c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-b-1c754c\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.258Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:44:35.258Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:44:35.260Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"28136b18bbee787efaef4d90cd72a43d56ec4b35fbd3beaf6ce6f87ea4b90f40","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["28136b18bbee787efaef4d90cd72a43d56ec4b35fbd3beaf6ce6f87ea4b90f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"28136b18bbee787efaef4d90cd72a43d56ec4b35fbd3beaf6ce6f87ea4b90f40\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.303Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w4-d48ff4\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.304Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w4-d48ff4\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.335Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"49d6367122e8f685bf87ec38fdc01a6adfd0079c8ab5c726f450cdd0a258b9f0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["49d6367122e8f685bf87ec38fdc01a6adfd0079c8ab5c726f450cdd0a258b9f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"49d6367122e8f685bf87ec38fdc01a6adfd0079c8ab5c726f450cdd0a258b9f0\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.426Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.532Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.613Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e1ba1fcd78b6f45236e7133c4c8a682fff5c8a90edf1c491c1a6c9f6fc59a8fb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e1ba1fcd78b6f45236e7133c4c8a682fff5c8a90edf1c491c1a6c9f6fc59a8fb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e1ba1fcd78b6f45236e7133c4c8a682fff5c8a90edf1c491c1a6c9f6fc59a8fb\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.686Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4212115f5775158988fd933ab792231c9545f0394df3f7133bda1a9176c29231","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4212115f5775158988fd933ab792231c9545f0394df3f7133bda1a9176c29231"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4212115f5775158988fd933ab792231c9545f0394df3f7133bda1a9176c29231\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.759Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.842Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"48d32f004a90987e2d112af753dfaee09d5de326bbf046cfc85875d3769d346b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["48d32f004a90987e2d112af753dfaee09d5de326bbf046cfc85875d3769d346b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"48d32f004a90987e2d112af753dfaee09d5de326bbf046cfc85875d3769d346b\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.917Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"edf8b07d6d790c65dee7efc076451be90096254d4f7aaf687d86ada4373f207c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["edf8b07d6d790c65dee7efc076451be90096254d4f7aaf687d86ada4373f207c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-1c754c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"edf8b07d6d790c65dee7efc076451be90096254d4f7aaf687d86ada4373f207c\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:35.990Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:36.070Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:36.168Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-1c8dd4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:55Z","generation":13,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"1022736a-9ea6-46d7-9666-09e1fa7f216f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:21:35Z"}],"name":"kuadrant-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-1c8dd4","uid":"1022736a-9ea6-46d7-9666-09e1fa7f216f"}],"resourceVersion":"46954","uid":"c24c7f5a-e883-441b-9157-1c12216ad398"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d722f2773a064322e4f94bdd5518f8f21a17a4d3e9be728f24cfb4fd345e4e9a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"fe2d1bb96a8aaf1ce9dcb9486703a202aee72f3d53ae431bd7231723e5bd74fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"98975d104850538a792ccd19e2cc94afc3ee0ae0c91994978b98ef785cbde53d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"e044ebc76d11ae8f0f4842359b3802e3110f11079391259eeb5fc8dcd8fe98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"872c935eb7627fa9e9b54e9b64feca8fcf4db2fc6263c2ad9182de3020414f41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c16aef0a553732620ab3d17553727fd98cffa1f02446927a150f00d70e52c05a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"8a830d301ff5a71a133f2e5920a029e3ec3236b99ca7c335ce75edb2f135cd0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"8eba5c5e5bca470bce8d31262b89d1a43c350d64321474cb1389e98cce8f81c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"18618e03f7ceb171bbfc4325ef3055eae56f1ab466480d27270950382def7ee6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7e18ce43d7153957576261ea6bd1838cbd27e9221d7441a51d3b82467e783035\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"72ff7a0549b7f2b4006712493670cf5bcb7f7c53bc5317086464e575e8708f51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"55e881ef18d3f986c22031330e1ac075317ff8c7a8c7ff4fb15e6284e746f1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"deaeb61d09ab93f9f03227f87c16291cbf69018e9b985f45af50fd6bac96a4f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"498e7720200a468d4042e9bd9edeeb8ffed0aad4fe195cb3de0aaa2e7b1f7aa9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5557f0c59061b9b2fd5291c9ae974f8090764d56f8782ad1be7d9aa685dd069c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f2099f4d971741a51df3897453c41156341ec88be3551211a725467a0adbfd02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7a86223ba61568a2770448435689d6367383b116887b4e0f962f92d21f0d767b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"8ebb2e74c2ea0f835197bd8ac2f8e5e6aef50a2f05b7cab55e49ad3d0430e3ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"40baba532e9d879d798fe30bfe9c0d11138364343b9474190f8aad3b7b1f6915\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"dd26f053dbf977b8b193971505e36b6a07a706e3ed9c8e63c379ac2293d82dc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"06e7cf7c58cdf904f2014d394fc10aae12621f7f0d3ebe5dd26256424fc624be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2e73311a2a5aabc79b44092dbee50596338ae09ffb74ee1ec20dbf97865ad4a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"a2c40926c96848a1f64e2f8432e7be0de6c63c281170eedd68453cf218b53470\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"eb903fb2f395cd1e0cd0ece3e9569e47debc23b27198f10c2c299239c6fbc66e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f43c5685eb05b429ea9501f8435e99a510dded670763fd887490394976e47203\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"2f7853168e97bf4316ce3f174e5e8f601ff9b2184251eb8a5ff8c571e9117ad6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"07c8be951648c49fa94df5e261fd72b0d6a55d6d12d56aa4f6195a28d45ad73f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"2e484b0f507b4aef3f88f2d59b9740828b5202265477def64972b5a1e9821558\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c54fca81c42e570a25905b3c6c7d0a776654133d335a9e76b5c542fdd08244f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"88bfc8c650c883186ac394d93461aaf7a113b8086749088f88121f96d71bc350\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"b4c9c4ef3b7ed99d874118d7d71fab084fd2693839924bcb9390472e1aa57efb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"6761fc9095f50680da68f052e7bb745937e12a7fe6c0d00779b9df73c6ec1407\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"107c4fd088c79ed8fec71659768d87991ca27c12f0933f5856b0da18ddfa028e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"56d39e4652a0a101893e398463abb10dc9823cfd47192cabdd002e4ee6f525d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40da9b1442f8c865c6738c60853d840efd8a82bd368270d0d17d96b7ed7c0efc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cbca1d8ed9ab62026715b9dd0f4379e9ed34062cb0c5ff54adae4211b08f6fb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f6f7631a002f287686d1a42dfe6abf8ac2d9bbb36ba7b84b485fd82541e3675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7ab78aa758093de3cb3dfc32bc45f25e16886a2fc5e1820b9d810fcd1d1bb21a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd316c1011be2ba1e92977697277c74807ad2d7d8863195c9ce94350cab7ff36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fac652fd9b1dc98ff92020b3cf0cdf4d301a3c4bc17712267db67f99723e5918\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b46d7a290c8c6c1a20e45d9a689facdaf1135fae0cc244ef0623792814525c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"d30fac8f2fb796899bcd15432be29e9913ef74cc833b8fa9172fcb3032a894b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9b799c155c82bfacede075ce6f970c750ea8dde484ba3caa7b2a882b6227e2cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3664590b8723decda0f1deb0a6fac69e835aa6deb0d87841a8cb2078ce9eadbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08334bcfff931cd495c365f3735e3de949e766138a9b03ce39abc75f5f665541\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2987e31c5c3334f42edfdccb340b13f64ecb2e327c821bfe532cd3a9731cc0de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdd5f218bb1de67fdb4c5509a7e18511041e8821a02fa2e3f9adebc6b4874aa7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"4461e5dfd48fdc8eb0f2fa58b1fb467a8842997144340c53ec30b456d0c32819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa569c37ed600d105f8a2125beaf07c522497f53f11cf3099fd4e2348d46ec2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"304090cf99dcb2b139a39b24dbe0fc67b96e79e86d892ceecdd012c0fb5f51de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1eac59fc45114f2ce4deec1fdcf1c3fe2eb41f7adeda4c7ae7cfdc04fc65426\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"fa203dbd971b487b7333113774122af19d7dde397f3d8844cd2147b55778de4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1572ae59c6a795c338fb2bb2c6841973fa92ed1105168214da68a898a643cb43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"b9e1423918d69a0383c5a37f7b69c123793f9166183f73b9559bb7b0265193f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2e2ba829c80c6b7702bd26121920e6e561d643d373b81e6f19ca5d51bbdd17df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5e8ecb70760bbad248a21757c03c8916dfdcee1f2053ea966f59381c808149b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddca80e7dce3248bcb6173da3eae450a269cc516f706eef1eba2ea35c4a2688e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"abb79379262035a146f66aac08b02cff323165a37bacd7829b856522aca43887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaa1b2a1054fb53c8ff038dac01c6267251d8afd3e74e84cdc91d24302a4e4de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"88690102e83c0534cc670fe54962275c7b96e72ac65fdc7d75bd0787be36cd80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c93ae5417465b5195f2f67ba8d1b25b4900246774df9fe2f5df40220efbfcc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"067c2408bbf439d968882014e393801f8ee59b42a180a1e2f88edc16f1c380dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bea74a5e79312d86a7437b9b9107c9aa5f686e6d9a4148db2aa2d554135a8305\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f77376be4767c7f0d7b4cb876abc7c786544b05ffbf59e71c40ed738c0f23c8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7462618ce57719ee474fcda0c0f2b0a69b4be5f4fe22fb5a71662eace7c04552\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"610d27fbf7e70d25ca269c5f549054a67d35af30b7dd4fc784312db9cce4df23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6946f2258b914d5a4a901db43a29f69619f5914c83ce7f2253a5b15576a4bd1f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"982fadfb9a84692178e8203c6a490f473ab81889e372e8cb919c238a3141e193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e868ca29b1c1c2374441d92e4aaa1c6171e27635e90525412ba8c4bca24b59a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"585e58644bf42565979749c76320b49179d7aaafbcea3a586381c94c8ae91af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72285f03fe9b4e8619a5e1e3b78afb7d6a91af4b4ad126e8fe429adfa311785a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e39730b3bb03d3feaa6cedd97e009c3803c3c1e93b390e1f16359d23d2d4afa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f156043d80ae9202ec913856fc2ce218cc43b4082bacaa75b01f9a373ec0e57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"c8d3989af6b7881a200d5fae40430de3438a8a4fb910666ffb0c0fa3815ea2ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7a4155a07f6048125b423c1b6d272d77ea9bc24d7c897587107eb429ab2ab7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2ce83896170df3c28b859812d6e5a676644dc9aa0c347553cf19f4acaa03543e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07613ec6104cadec59fd785bcb990b5a38ea5343d6c74a38a40fad81b771b119\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"3dcf1f4a73977a1dad8f77938e6cb8b3e54b2d46359776c5af2e11edfab95c49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"250065119d3baa7879803f41eb65b32f6614a6a3f80fb2d03ecce0cc0e65ddef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5e826c20dd5710a6b7e7446075da02d64e4b09bc44ef94e039edb05484bfcc06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf1e7d0ef8559d974a1323420a3d396a5f1224745470bf01e5f84f9e90671cc6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7770ced6938234629c72124c64149fa0906e6875d3620e7f2a0b2b905a384722\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc98d55a5fcde068535f2fece4eb03bb9f733db252068dec8c93dd086be793a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"b51ab026204b7bae0773436ce72577fb27ecffcc646a0f6882afb62ede8abe6c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af5e6bdb6b32a2da886759932798d61fc00c2948cb89ef707a8c77de30dfbfc9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"27878634d95404360b653257f3b03d7fb2006ecd6ce2978b68a1d115150e59fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca78ecd27c5cb0159528b820a7be7092275b9c5abdc62b572dedb7e627141373\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fde88c7e29be0745a9e8705f9903954fa2823d8ad2133a839db3d5ed96adcfb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4de96f4310ada6e084741030e975dd1f38f92b2a8c4006206161b34924f621d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"025285dc38f097b725e71fec4cf5f71217b8dffd5d74f733fc8154e122b6034c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ccf4f502d8f42eaace6b37e237896d6658342da096b8598da2567e1a97cd7a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"f53d7752e5e8872a28aaf4951c5bb99e52039e2d080871c4e28011c2328f2109\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0442670ca837fcdf5b5b65185966e09a927dc7aa7c0ef0689658297531f91c7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"55f4c111860bc29246c5f77e3c4e7d48647a53865883b40ae1e8515b9d02d7e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"126b28f315255821a23330f516efbe14a895b48f838ed4577489e7c3a7e289df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"4589e1b797c1c898e5079ae6dc96acd6d38d4718919b2f08c1eb7206448b4ab2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"496e1bf7f5641b54d2165111905fa143e0caac6fab14aa60c4c4ba36d8450772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c345c923befde091471bab05f155033e00973c1f4322f2d695969ef630cdaa8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6fcf011ad844ec14108de764b81b128fdb18fca9ddf8aba8087b147dd4f5bfdb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e36e9ef49d9eee750dd3bdaf13f7427ea50658d943798c5936bd4022a828fe2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"667d3a93329c566724f271b9c13e60b7d3bdba5a17c57765887854900434892b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"1826d28a53942692d22546698b1e127e9f6cf018551f0976553bfa20e5361993\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b79bb31b42338d4a406a8314ccd79dd125fccbb0f1321cba1e6e2a76810ca65c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"505c2b2acb351d14b73deb47ddc79ae294a4d0b7167b7f38f6dba24dbf4019a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb8bac264d82224c8d8c821d533af6243655e8d48c8764ba43c2d9a52e624ff8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c1b45264e1ceea9ba7c7c57d22e4cee07e3c66a3f40f55a0fb2a02229878d689\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2a39cb466936ed344ff5b35e07f242e326fab27306803cb683ba6df545a69c4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"a0ffb3b8c11614dc5ff46348cca0e094c00ec437821e91a13a57b7b7a5195acc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2319eed8b4ef51b4414ccdc8857bd036554e70a55cfe750dc216906486952a53\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2eb301e5e4984be512b687e16a81a3a6a6ff2d80d4a23d38db2a15f8d2c5e23d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aeb0450fc0ede1b61e5bb1612230e6cc8cc7b2c66ff5bd0847078f3b01b444a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3224b08ceb25452655701219f7d2126150d377f4f0fcc7a7353e4e15cca11871\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8542b97537c28e07d57bd0a9c9474f31b46be9996c4e9bfc3475585960e95017\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7af45dbed1145cbefae25036f9b976a4ba04ff1bd6d65257c779e505c08e7664\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206405c4fb067243fdbd7964f80dd6bb48a9e3ce2c5335c82aca73c228e43441\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cae718fdd03b8a36914e865ce59f9f9820ec9eef12d4d0c9c6228b86a7fca262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"88058e8c9de15d7da1fea7024cba67237bdea366968f5e13ad3e9c0be8b34c46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"d78e0b7b2fff91bae4004dc0f09025510ecd9eb4f6ceef5f1004705995ee6e82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2028771388f8279a0773be1740d35e06fd4143c31788bceed01bae9e8689e4e8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cb1bb94e9eb8722108b82378027c9a6cc6927392f2679669c7127da5b93d7f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45b69d0a2617fdc908edabde94957a37df9bab4d7c8d1f0da2d3348571dfe24a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"58271f39ba379295948cabb3698a9f3eb43a28dfe7bfe008e8ed6a9586432164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8a5f0bed0ea44e46c7ffd9439a1c95a25744aaa30796c29dedf2f67e0718e99\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3588a32f4036d13fb6b19114219c46cf512773bda9a64cb8254668ce2f84bbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67f92abfa1830b39b11b6fba47fa111e608ce1ecaf6453884763534c3d3fb793\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a360331d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"90636f103ba51f93\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d43defb9cd59af289b9dfd9879f86908b2485fde88b5f2ad80ad79a573e5025c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a38a3aae7b31ec5ea9420576df60ef9fc1ea0e252b9d3d96184215ce79b3226\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"de97507b575cf8eeb6ed5f8969e3e733c20f8d71018e39890aa1f57e803f4cf2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3e3834d3118318c51dffc32390603e36934595c5092fba7c22201192be37f07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"dea8f45890cf588ef4a93ce717a6523504e30c4b7c1cf6c22aaf2399d55c00f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce72d6ea777e1d3f6b60618a850b52e098222a66964c7963514746d1d3dfe27\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"e8ccecc36ea50ab185e2cb24105f0d05a0d27ca156cd2483b712a076fcbf67d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-1c8dd4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:36.174Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:36.236Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-1c754c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-praxis-b-1c754c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-1c754c","uid":"00f7755d-f779-4d65-81de-2869b7207695"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edf8b07d6d790c65dee7efc076451be90096254d4f7aaf687d86ada4373f207c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"e8520a564dbcbfb0211a2e2a60cc2f853031fcce5ae49d58331a168312f5e0d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4212115f5775158988fd933ab792231c9545f0394df3f7133bda1a9176c29231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"a23ceed40a5e60149ce1ddbeac6216918e372911a8d5062688623e28d9622d73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"28136b18bbee787efaef4d90cd72a43d56ec4b35fbd3beaf6ce6f87ea4b90f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"bd6b311cce51bda97c9b3fac9d7660e9433aa053feab856823ef54189cf46b2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"49d6367122e8f685bf87ec38fdc01a6adfd0079c8ab5c726f450cdd0a258b9f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"6975b469fe62f5b5d4a43814eca3c96eee61a186c44c9f9c295457cf7325ff84\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1ba1fcd78b6f45236e7133c4c8a682fff5c8a90edf1c491c1a6c9f6fc59a8fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"debb8028c4ceded5ca3e7675182c9731030ddeb98cb58eb46f65c14af83317a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48d32f004a90987e2d112af753dfaee09d5de326bbf046cfc85875d3769d346b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"4329ccd0b44bbbb47d72145ed9594415aecad7df44f2952dc8c610cbd8c5bab4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-1c754c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-1c754c\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:36.490Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"a8145813a9b56dc34ed50dd81fc379ed19f75a26ecc67269c54fb433b09cd1a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"dbd867a3282f4d3f0b2224e9a0a717b6688c4853b976493add937469edc9dfb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"79016ee4b4f966cf6c441f34579ea049f63637553b8193324bae0aa836b2db7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"df2665493c1179abe9d1eb2a996b4ad965011d3b3e7e7451c8f64999ea7e5e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"c8cc7f1ee42f8704cc0aa6fe662e93eb76b065868d0b1ca19a262a9434302ebe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"37694e0fe4a8a4daee6cd09ea67587f3f90a67fba636fb5f0a92fd82ec0cf000\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-d48ff4\" already exists"}
{"level":"error","ts":"2026-11-04T00:44:36.842Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:36.901Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:37.144Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:37.168Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-1c754c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-b-1c754c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:37.313Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-e89576-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-e89576-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:37.774Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-d48ff4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-d48ff4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:37.840Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-1c754c","namespace":"openshift-ingress","uid":"932b2fef-245a-4f37-b2f3-78a6fe778eec","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-1c754c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:44:38.349Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:38.349Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:44:38.635Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-w4-d48ff4","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:38.802Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-praxis-b-1c754c","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-praxis-b-1c754c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:39.213Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-1c754c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-1c754c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:39.407Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w2-516871","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:44:39.468Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:44:50.356Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","HTTPRoute","AuthConfig","AuthPolicy","Limitador","TokenRateLimitPolicy","Gateway","EnvoyFilter","ConfigMap"],"eventTypes":{"create":22,"update":16}}
{"level":"info","ts":"2026-11-04T00:44:50.711Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:50.731Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:53.621Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:44:53.958Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:44:54.020Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:44:54.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:44:54.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:44:57.533Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:44:57.534Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:57.550Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:44:57.550Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:44:57.552Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:44:57.552Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:44:57.706Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:45:01.232Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:01.233Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:45:03.141Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-04T00:45:09.698Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:09.705Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:45:09.698Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:45:09.716Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:45:09.718Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:09.718Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:45:09.914Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-516871","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-b-w2-516871","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-516871","uid":"59262430-a65d-4fb9-8082-a5ebbf86b6f6"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-516871"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w2-516871\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:09.915Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-516871","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-b-w2-516871","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-516871","uid":"59262430-a65d-4fb9-8082-a5ebbf86b6f6"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-516871"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w2-516871\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:09.915Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:45:09.915Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:45:09.915Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.013Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.086Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.186Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.237Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-516871","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-b-w2-516871","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-516871","uid":"59262430-a65d-4fb9-8082-a5ebbf86b6f6"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"b0bdf1559fb724e46b834693961ac80012ba18b84f1f7e761830354d69b6c20f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6118ee007d06753619cdd3723e5f364a3646a3c9d99cd0e248a2b041cedc688e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"ae0c5d6228fd93a9b5aa81cf9c846a9343adbd4f82f7085a13f27f7d910fe0c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"93f6801119535020e051e319ff1814709e08eba59d41d11da398d6675db1d33b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"c43b20454038dbfa463db22fa3ec806267111d0d7471710a880d546f9c04b08c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6a5ce3b5e4931a7f21c9b99482f16a36f46eb3341d6754ac80a7a492496aaca3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-516871"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-516871\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.259Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.330Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.409Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.482Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.557Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.633Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.705Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.782Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.860Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:10.933Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:11.007Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:11.079Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:11.156Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-1c8dd4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:55Z","generation":14,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"1022736a-9ea6-46d7-9666-09e1fa7f216f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:24Z"}],"name":"kuadrant-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-1c8dd4","uid":"1022736a-9ea6-46d7-9666-09e1fa7f216f"}],"resourceVersion":"88039","uid":"c24c7f5a-e883-441b-9157-1c12216ad398"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d722f2773a064322e4f94bdd5518f8f21a17a4d3e9be728f24cfb4fd345e4e9a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"fe2d1bb96a8aaf1ce9dcb9486703a202aee72f3d53ae431bd7231723e5bd74fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"98975d104850538a792ccd19e2cc94afc3ee0ae0c91994978b98ef785cbde53d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"e044ebc76d11ae8f0f4842359b3802e3110f11079391259eeb5fc8dcd8fe98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"872c935eb7627fa9e9b54e9b64feca8fcf4db2fc6263c2ad9182de3020414f41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c16aef0a553732620ab3d17553727fd98cffa1f02446927a150f00d70e52c05a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"8a830d301ff5a71a133f2e5920a029e3ec3236b99ca7c335ce75edb2f135cd0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"8eba5c5e5bca470bce8d31262b89d1a43c350d64321474cb1389e98cce8f81c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"18618e03f7ceb171bbfc4325ef3055eae56f1ab466480d27270950382def7ee6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7e18ce43d7153957576261ea6bd1838cbd27e9221d7441a51d3b82467e783035\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"72ff7a0549b7f2b4006712493670cf5bcb7f7c53bc5317086464e575e8708f51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"55e881ef18d3f986c22031330e1ac075317ff8c7a8c7ff4fb15e6284e746f1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"deaeb61d09ab93f9f03227f87c16291cbf69018e9b985f45af50fd6bac96a4f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"498e7720200a468d4042e9bd9edeeb8ffed0aad4fe195cb3de0aaa2e7b1f7aa9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5557f0c59061b9b2fd5291c9ae974f8090764d56f8782ad1be7d9aa685dd069c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f2099f4d971741a51df3897453c41156341ec88be3551211a725467a0adbfd02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7a86223ba61568a2770448435689d6367383b116887b4e0f962f92d21f0d767b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"8ebb2e74c2ea0f835197bd8ac2f8e5e6aef50a2f05b7cab55e49ad3d0430e3ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"40baba532e9d879d798fe30bfe9c0d11138364343b9474190f8aad3b7b1f6915\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"dd26f053dbf977b8b193971505e36b6a07a706e3ed9c8e63c379ac2293d82dc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"06e7cf7c58cdf904f2014d394fc10aae12621f7f0d3ebe5dd26256424fc624be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2e73311a2a5aabc79b44092dbee50596338ae09ffb74ee1ec20dbf97865ad4a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"a2c40926c96848a1f64e2f8432e7be0de6c63c281170eedd68453cf218b53470\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"eb903fb2f395cd1e0cd0ece3e9569e47debc23b27198f10c2c299239c6fbc66e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f43c5685eb05b429ea9501f8435e99a510dded670763fd887490394976e47203\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"2f7853168e97bf4316ce3f174e5e8f601ff9b2184251eb8a5ff8c571e9117ad6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"07c8be951648c49fa94df5e261fd72b0d6a55d6d12d56aa4f6195a28d45ad73f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"2e484b0f507b4aef3f88f2d59b9740828b5202265477def64972b5a1e9821558\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3df7203d9172eed7b78a48b5f673298ee447f975fe223818bb8a0f56ffac241\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c54fca81c42e570a25905b3c6c7d0a776654133d335a9e76b5c542fdd08244f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e92ea428244aaa6034f549816c50a365598d0545b9b607c9e54b0680734ce6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"88bfc8c650c883186ac394d93461aaf7a113b8086749088f88121f96d71bc350\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1c490d0a8c76ce407763d29b40376b7ea0b99efe7c9863d4f2b46f6724a1772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"b4c9c4ef3b7ed99d874118d7d71fab084fd2693839924bcb9390472e1aa57efb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d334166b5f9c3434d6c45be28e12a73bddb719a7bca93751b62ddcefc866b7dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"6761fc9095f50680da68f052e7bb745937e12a7fe6c0d00779b9df73c6ec1407\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"107c4fd088c79ed8fec71659768d87991ca27c12f0933f5856b0da18ddfa028e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"56d39e4652a0a101893e398463abb10dc9823cfd47192cabdd002e4ee6f525d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40da9b1442f8c865c6738c60853d840efd8a82bd368270d0d17d96b7ed7c0efc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cbca1d8ed9ab62026715b9dd0f4379e9ed34062cb0c5ff54adae4211b08f6fb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f6f7631a002f287686d1a42dfe6abf8ac2d9bbb36ba7b84b485fd82541e3675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"7ab78aa758093de3cb3dfc32bc45f25e16886a2fc5e1820b9d810fcd1d1bb21a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd316c1011be2ba1e92977697277c74807ad2d7d8863195c9ce94350cab7ff36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fac652fd9b1dc98ff92020b3cf0cdf4d301a3c4bc17712267db67f99723e5918\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b46d7a290c8c6c1a20e45d9a689facdaf1135fae0cc244ef0623792814525c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"d30fac8f2fb796899bcd15432be29e9913ef74cc833b8fa9172fcb3032a894b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9b799c155c82bfacede075ce6f970c750ea8dde484ba3caa7b2a882b6227e2cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3664590b8723decda0f1deb0a6fac69e835aa6deb0d87841a8cb2078ce9eadbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08334bcfff931cd495c365f3735e3de949e766138a9b03ce39abc75f5f665541\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2987e31c5c3334f42edfdccb340b13f64ecb2e327c821bfe532cd3a9731cc0de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdd5f218bb1de67fdb4c5509a7e18511041e8821a02fa2e3f9adebc6b4874aa7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"4461e5dfd48fdc8eb0f2fa58b1fb467a8842997144340c53ec30b456d0c32819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa569c37ed600d105f8a2125beaf07c522497f53f11cf3099fd4e2348d46ec2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"304090cf99dcb2b139a39b24dbe0fc67b96e79e86d892ceecdd012c0fb5f51de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1eac59fc45114f2ce4deec1fdcf1c3fe2eb41f7adeda4c7ae7cfdc04fc65426\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"fa203dbd971b487b7333113774122af19d7dde397f3d8844cd2147b55778de4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1572ae59c6a795c338fb2bb2c6841973fa92ed1105168214da68a898a643cb43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"b9e1423918d69a0383c5a37f7b69c123793f9166183f73b9559bb7b0265193f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2e2ba829c80c6b7702bd26121920e6e561d643d373b81e6f19ca5d51bbdd17df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5e8ecb70760bbad248a21757c03c8916dfdcee1f2053ea966f59381c808149b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddca80e7dce3248bcb6173da3eae450a269cc516f706eef1eba2ea35c4a2688e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"abb79379262035a146f66aac08b02cff323165a37bacd7829b856522aca43887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaa1b2a1054fb53c8ff038dac01c6267251d8afd3e74e84cdc91d24302a4e4de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"88690102e83c0534cc670fe54962275c7b96e72ac65fdc7d75bd0787be36cd80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c93ae5417465b5195f2f67ba8d1b25b4900246774df9fe2f5df40220efbfcc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"067c2408bbf439d968882014e393801f8ee59b42a180a1e2f88edc16f1c380dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bea74a5e79312d86a7437b9b9107c9aa5f686e6d9a4148db2aa2d554135a8305\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"f77376be4767c7f0d7b4cb876abc7c786544b05ffbf59e71c40ed738c0f23c8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7462618ce57719ee474fcda0c0f2b0a69b4be5f4fe22fb5a71662eace7c04552\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"610d27fbf7e70d25ca269c5f549054a67d35af30b7dd4fc784312db9cce4df23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6946f2258b914d5a4a901db43a29f69619f5914c83ce7f2253a5b15576a4bd1f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"982fadfb9a84692178e8203c6a490f473ab81889e372e8cb919c238a3141e193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e868ca29b1c1c2374441d92e4aaa1c6171e27635e90525412ba8c4bca24b59a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"585e58644bf42565979749c76320b49179d7aaafbcea3a586381c94c8ae91af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72285f03fe9b4e8619a5e1e3b78afb7d6a91af4b4ad126e8fe429adfa311785a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e39730b3bb03d3feaa6cedd97e009c3803c3c1e93b390e1f16359d23d2d4afa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f156043d80ae9202ec913856fc2ce218cc43b4082bacaa75b01f9a373ec0e57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"c8d3989af6b7881a200d5fae40430de3438a8a4fb910666ffb0c0fa3815ea2ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7a4155a07f6048125b423c1b6d272d77ea9bc24d7c897587107eb429ab2ab7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2ce83896170df3c28b859812d6e5a676644dc9aa0c347553cf19f4acaa03543e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07613ec6104cadec59fd785bcb990b5a38ea5343d6c74a38a40fad81b771b119\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"3dcf1f4a73977a1dad8f77938e6cb8b3e54b2d46359776c5af2e11edfab95c49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"250065119d3baa7879803f41eb65b32f6614a6a3f80fb2d03ecce0cc0e65ddef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"5e826c20dd5710a6b7e7446075da02d64e4b09bc44ef94e039edb05484bfcc06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf1e7d0ef8559d974a1323420a3d396a5f1224745470bf01e5f84f9e90671cc6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7770ced6938234629c72124c64149fa0906e6875d3620e7f2a0b2b905a384722\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc98d55a5fcde068535f2fece4eb03bb9f733db252068dec8c93dd086be793a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"b51ab026204b7bae0773436ce72577fb27ecffcc646a0f6882afb62ede8abe6c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af5e6bdb6b32a2da886759932798d61fc00c2948cb89ef707a8c77de30dfbfc9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"27878634d95404360b653257f3b03d7fb2006ecd6ce2978b68a1d115150e59fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca78ecd27c5cb0159528b820a7be7092275b9c5abdc62b572dedb7e627141373\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"fde88c7e29be0745a9e8705f9903954fa2823d8ad2133a839db3d5ed96adcfb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4de96f4310ada6e084741030e975dd1f38f92b2a8c4006206161b34924f621d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"025285dc38f097b725e71fec4cf5f71217b8dffd5d74f733fc8154e122b6034c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ccf4f502d8f42eaace6b37e237896d6658342da096b8598da2567e1a97cd7a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"f53d7752e5e8872a28aaf4951c5bb99e52039e2d080871c4e28011c2328f2109\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0442670ca837fcdf5b5b65185966e09a927dc7aa7c0ef0689658297531f91c7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"55f4c111860bc29246c5f77e3c4e7d48647a53865883b40ae1e8515b9d02d7e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"126b28f315255821a23330f516efbe14a895b48f838ed4577489e7c3a7e289df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"4589e1b797c1c898e5079ae6dc96acd6d38d4718919b2f08c1eb7206448b4ab2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"496e1bf7f5641b54d2165111905fa143e0caac6fab14aa60c4c4ba36d8450772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"c345c923befde091471bab05f155033e00973c1f4322f2d695969ef630cdaa8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6fcf011ad844ec14108de764b81b128fdb18fca9ddf8aba8087b147dd4f5bfdb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"7e36e9ef49d9eee750dd3bdaf13f7427ea50658d943798c5936bd4022a828fe2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"667d3a93329c566724f271b9c13e60b7d3bdba5a17c57765887854900434892b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"1826d28a53942692d22546698b1e127e9f6cf018551f0976553bfa20e5361993\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b79bb31b42338d4a406a8314ccd79dd125fccbb0f1321cba1e6e2a76810ca65c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"505c2b2acb351d14b73deb47ddc79ae294a4d0b7167b7f38f6dba24dbf4019a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb8bac264d82224c8d8c821d533af6243655e8d48c8764ba43c2d9a52e624ff8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"c1b45264e1ceea9ba7c7c57d22e4cee07e3c66a3f40f55a0fb2a02229878d689\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2a39cb466936ed344ff5b35e07f242e326fab27306803cb683ba6df545a69c4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"a0ffb3b8c11614dc5ff46348cca0e094c00ec437821e91a13a57b7b7a5195acc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2319eed8b4ef51b4414ccdc8857bd036554e70a55cfe750dc216906486952a53\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"2eb301e5e4984be512b687e16a81a3a6a6ff2d80d4a23d38db2a15f8d2c5e23d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aeb0450fc0ede1b61e5bb1612230e6cc8cc7b2c66ff5bd0847078f3b01b444a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3224b08ceb25452655701219f7d2126150d377f4f0fcc7a7353e4e15cca11871\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8542b97537c28e07d57bd0a9c9474f31b46be9996c4e9bfc3475585960e95017\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"7af45dbed1145cbefae25036f9b976a4ba04ff1bd6d65257c779e505c08e7664\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206405c4fb067243fdbd7964f80dd6bb48a9e3ce2c5335c82aca73c228e43441\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cae718fdd03b8a36914e865ce59f9f9820ec9eef12d4d0c9c6228b86a7fca262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"88058e8c9de15d7da1fea7024cba67237bdea366968f5e13ad3e9c0be8b34c46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"d78e0b7b2fff91bae4004dc0f09025510ecd9eb4f6ceef5f1004705995ee6e82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2028771388f8279a0773be1740d35e06fd4143c31788bceed01bae9e8689e4e8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"cb1bb94e9eb8722108b82378027c9a6cc6927392f2679669c7127da5b93d7f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45b69d0a2617fdc908edabde94957a37df9bab4d7c8d1f0da2d3348571dfe24a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"58271f39ba379295948cabb3698a9f3eb43a28dfe7bfe008e8ed6a9586432164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8a5f0bed0ea44e46c7ffd9439a1c95a25744aaa30796c29dedf2f67e0718e99\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-1c8dd4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"3588a32f4036d13fb6b19114219c46cf512773bda9a64cb8254668ce2f84bbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67f92abfa1830b39b11b6fba47fa111e608ce1ecaf6453884763534c3d3fb793\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__965a3234\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"cc052e326d5edf5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/simulator-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-simulator-w0-1c8dd4\"]}],\"name\":\"d43defb9cd59af289b9dfd9879f86908b2485fde88b5f2ad80ad79a573e5025c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/simulator-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a38a3aae7b31ec5ea9420576df60ef9fc1ea0e252b9d3d96184215ce79b3226\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bfc3a087\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"2cd4288e6e8c38bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/premium-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-1c8dd4/maas-trlp-premium-w0-1c8dd4\"]}],\"name\":\"de97507b575cf8eeb6ed5f8969e3e733c20f8d71018e39890aa1f57e803f4cf2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/premium-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3e3834d3118318c51dffc32390603e36934595c5092fba7c22201192be37f07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"dea8f45890cf588ef4a93ce717a6523504e30c4b7c1cf6c22aaf2399d55c00f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-w0-1c8dd4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce72d6ea777e1d3f6b60618a850b52e098222a66964c7963514746d1d3dfe27\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-1c8dd4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__747a5ae1\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-1c8dd4/distinct-2-w0-1c8dd4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-1c8dd4\"]}],\"name\":\"e8ccecc36ea50ab185e2cb24105f0d05a0d27ca156cd2483b712a076fcbf67d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-1c8dd4/models/e2e/distinct-2-w0-1c8dd4')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-1c8dd4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:11.160Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:11.243Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\" already exists"}
{"level":"error","ts":"2026-11-04T00:45:11.453Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w3-a4fac5","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:41:56Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"0d9286a3-fc07-43a3-ae3f-1766edb49dd0\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:56Z"}],"name":"kuadrant-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w3-a4fac5","uid":"0d9286a3-fc07-43a3-ae3f-1766edb49dd0"}],"resourceVersion":"84021","uid":"b07661a3-d588-443c-b547-70c1165efbf4"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"1430a5f7cebb9d77677f183f65da9337d152a48bfafe3d37cfcd270307c7df9e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"55b91b030f20771875d8f6034586faa2db4fbc70eb10fb8d132882c15d0afaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"a81d3eff92e27ea5f5cac2db6fb0cf1a069bd951f29c48d484e8112db696880b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"d1c07ab63c7120efa7dccc42f9baaadb433c223ccbd44f804d37690d09425337\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"35a8564f19c1b3aa575d12e397fea0f23fdcdb16ef009f7564dc7ef4be46ee1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"cdfcd2d814c040588e2b1d88d65f9904cb2634712e56955e87a10b0a9a284568\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"108afa169d39fac08de3bfac4f917f03a000504129040f5dc69a2cf196d15bef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"618a90afaf2ea3c705eeac6f41eeabe561b7901fd9147e2071041c6dbb9db9d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"d21a8dbe4d63c1c76c5803889f0ed2b730249d1b48deb712d825daaa4657aaa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"a79d526802843d064aaa2681f2c6d0f890771839ea1eac1556af53e244c7789c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"bfa2ba133701eb0e4e8b1d9e8cff1c70e4152f4531e4bed579458e3897adac39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"dd07a42cbcc7b6ddb89e0ec031168dc4efd39f5fa2d09a3fb842bc0e8b36cee5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"58b33325da28633c2008f7546fee7584b31d404a57cae8a513b38540583b99d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"87e211399dd3bc3d5c1c424239aeb9399f8d04930fa1354a47995f4ae7147493\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"117cdacbdcc2d37da88ad7414ee2519e9ea13a4a30beef73141dcf36a5e4e8a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"a18b0cb0515a2d7f89035cc7abe4cf8dc535d97184538512401ebe29a6152281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"e259fd19a243470b41846cb89513e1f971b70d69b06abaa114e30229c21f4476\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"420f7a9f443a7dc911301904acf52fe84803c60cc435cd53fbfc3c99510d0259\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"0e76def713d30875a17e15c7a8c10c6ffd261a73e93b981aa4748f08f77984ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"c9acea04cbf39f2981dd1a245f18178f137cd6d2d7a643adbca92f59a142c153\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"e1d0e1b4476a1281d74748638e5802057df5161cf75b5267cf760ed1152999d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"340368d8ddc2b2ef6abd4fa7792745eac63d8424a90ecb186cc80096c6eb39ef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"1a7c82c7f9d0780636e05434bdf6e53e13e198a50a23623c5f9f6466c79dcea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"15031e7a1557e38e5db1b74edd83508a08c14602d4fdcd67811e608dfee97daa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"0469aa6ed59e67d28f54962ab8e4029c4dfea8f6a9d9fa9b5071633d22937209\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w3-a4fac5"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:11.947Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-1c754c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-b-1c754c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:11.995Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:12.254Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-d48ff4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-d48ff4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:12.422Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-a4fac5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-a4fac5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:12.571Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-516871-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-516871-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:12.656Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:12.997Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-1c754c","namespace":"openshift-ingress","uid":"932b2fef-245a-4f37-b2f3-78a6fe778eec","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-1c754c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:13.189Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:45:13.321Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:13.324Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:45:13.639Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-a4fac5-kserve-route","namespace":"ai-tenant-e2e-shared-a-w3-a4fac5","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-a4fac5-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:13.764Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-w2-516871","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:45:14.068Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w2-516871","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:45:22.354Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","EnvoyFilter","AuthConfig","AuthPolicy","Limitador","Gateway","ConfigMap"],"eventTypes":{"create":21,"update":15}}
{"level":"info","ts":"2026-11-04T00:45:22.757Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:24.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:45:25.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:45:25.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:45:28.644Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:45:28.644Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:28.662Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:45:28.662Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:45:28.663Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:28.663Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:45:28.667Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:45:31.860Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:31.860Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:45:36.634Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"update":24}}
{"level":"info","ts":"2026-11-04T00:45:36.980Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:38.845Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:45:38.960Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:45:38.960Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:45:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","reconcileID":"90a65d16-283a-496e-819b-85b3f31afffb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:45:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:45:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:45:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:45:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:45:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:45:40Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","reconcileID":"6614ffe6-7bd3-4a68-b62a-0d496363b91c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:45:40Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","reconcileID":"6614ffe6-7bd3-4a68-b62a-0d496363b91c"}
{"level":"error","ts":"2026-11-04T00:45:40Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","reconcileID":"6614ffe6-7bd3-4a68-b62a-0d496363b91c","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:45:40Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","reconcileID":"cb09f2f9-9d9d-401d-bec4-b8e6f3e15bbf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:45:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:45:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:45:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:45:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:45:41Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:45:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:45:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T00:45:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:45:42.360Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:45:42.413Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:42.413Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:45:42.419Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:45:42.419Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:45:42.419Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:42.419Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:45:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:45:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:45:42Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:45:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:45:45.619Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:45.619Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:45:46.541Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-209995","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","reconcileID":"adc24233-458f-454c-a387-3c6aa2373d4e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","reconcileID":"adc24233-458f-454c-a387-3c6aa2373d4e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-22de5b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-22de5b","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-22de5b\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:45:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:45:57.416Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Gateway","HTTPRoute","AuthPolicy","Kuadrant"],"eventTypes":{"create":3,"delete":1,"update":4}}
{"level":"info","ts":"2026-11-04T00:45:57.747Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:45:57.756Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:00.729Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:00.859Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:46:01.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:46:01.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:01.222Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:46:04.840Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:46:04.851Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:04.858Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:46:04.859Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:46:04.914Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:04.914Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:05.015Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:46:05.070Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-a-22de5b","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-22de5b\" not found"}
{"level":"error","ts":"2026-11-04T00:46:05.070Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-a-22de5b","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-22de5b\" not found"}
{"level":"info","ts":"2026-11-04T00:46:08.513Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:08.514Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:10.242Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway","AuthPolicy"],"eventTypes":{"create":1,"delete":3,"update":1}}
{"level":"info","ts":"2026-11-04T00:46:16.760Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:46:16.762Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:16.824Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:46:16.826Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:46:16.832Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:16.832Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:46:16.873Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-autores-209995","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-autores-209995","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-autores-209995","uid":"5de0ac64-6b2e-4903-9c82-a65f4aa3de75"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-autores-209995"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-autores-209995\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:16.882Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-autores-209995","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-autores-209995","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-autores-209995","uid":"5de0ac64-6b2e-4903-9c82-a65f4aa3de75"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-autores-209995"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-autores-209995\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:16.884Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-209995#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e981097a6e87c87d16ffc9ff10c0cd68196322193707be75767ccbaf25856e09","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e981097a6e87c87d16ffc9ff10c0cd68196322193707be75767ccbaf25856e09"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e981097a6e87c87d16ffc9ff10c0cd68196322193707be75767ccbaf25856e09\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:16.919Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:46:16.919Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:46:16.932Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-a-22de5b","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-22de5b\" not found"}
{"level":"error","ts":"2026-11-04T00:46:16.937Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-a-22de5b","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-22de5b\" not found"}
{"level":"error","ts":"2026-11-04T00:46:16.959Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-209995#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ad176d6926415a8a987ba0a153c4e117e5515941e4f35997708103f0ac7c5322","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad176d6926415a8a987ba0a153c4e117e5515941e4f35997708103f0ac7c5322"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ad176d6926415a8a987ba0a153c4e117e5515941e4f35997708103f0ac7c5322\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.036Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2ad4c2008f2bcb23bed1eaab3ee0e8664a67c9296abb21de7134a35b26d400a4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ad4c2008f2bcb23bed1eaab3ee0e8664a67c9296abb21de7134a35b26d400a4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2ad4c2008f2bcb23bed1eaab3ee0e8664a67c9296abb21de7134a35b26d400a4\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.109Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b4960ec1dabe36ebc181f4cbc408770cf42c568ee0268ff071904ca6708f2dca","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b4960ec1dabe36ebc181f4cbc408770cf42c568ee0268ff071904ca6708f2dca"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b4960ec1dabe36ebc181f4cbc408770cf42c568ee0268ff071904ca6708f2dca\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.197Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-209995#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5071fd796776da52e7d80bcaf6ad0b1bc9d2831030b0e7dd06f57fab7354a9bb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5071fd796776da52e7d80bcaf6ad0b1bc9d2831030b0e7dd06f57fab7354a9bb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5071fd796776da52e7d80bcaf6ad0b1bc9d2831030b0e7dd06f57fab7354a9bb\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.270Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"64a5d239b15e872fe93650a6717424803592cf65b7b48fc64854676a213c6dd6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["64a5d239b15e872fe93650a6717424803592cf65b7b48fc64854676a213c6dd6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"64a5d239b15e872fe93650a6717424803592cf65b7b48fc64854676a213c6dd6\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.347Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-209995#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f168f4583d712cb62b7566a86061d952d25e99fe65d89b3a15fac288156ed408","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f168f4583d712cb62b7566a86061d952d25e99fe65d89b3a15fac288156ed408"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f168f4583d712cb62b7566a86061d952d25e99fe65d89b3a15fac288156ed408\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.422Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ad94934bef7002e6d043e62454d4634ace243fcb94fe18493e1d5f16b1f3bed9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad94934bef7002e6d043e62454d4634ace243fcb94fe18493e1d5f16b1f3bed9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ad94934bef7002e6d043e62454d4634ace243fcb94fe18493e1d5f16b1f3bed9\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.517Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-ad3cbc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:42:33Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"76771efd-f8cb-4c36-a180-ec37c18f7a04\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:42:33Z"}],"name":"kuadrant-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-ad3cbc","uid":"76771efd-f8cb-4c36-a180-ec37c18f7a04"}],"resourceVersion":"84953","uid":"100f1380-dea9-4628-a307-626162a0de0f"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"aca16e40627367672911feca4ce7ad8c7d10d0c56a9325a9e9042bdfd312ef5a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"5a35fdf440eb1747f0be7d455fcfcf3c07d25c89609f6b49de909135f9165e97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"7093b3a7d38a93fe38d15834adee61e774120fc2c6a0a3894d3c9255294d1c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"bf2b84457e3fac0dbbcfb3cd9bc82f8514255d2eab07c515b0a29327111fbf99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"7d6dfd905dfa95d9a351dbf895654fe4790d21b1adb8582c116209e79306ecf8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"bbd7f964f8078aaa0f5cc62772775672e33d6cd9dcb67f160a15a881acecffa4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"fbb73665de5400bd2b83e1ecbdc627914e657558a54f2b2c84717502cc63d11a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"4df7175c09f43736bd518303d83e3acf28cdd2af2c5e200955e6430cea58c30b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"9bf97f063f975f92080a902131d0daa53318e53d91b57013cbc27123f26504c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdced85e7d18606f04f9395e95e53b677eb683995d773e98eaf2786a2c5c30d7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"b92fc0814a30fac54f2f9dee4eb549a7a521f2f3def3a796f51530ff0f145629\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b076518fe7919b1938e36a5b319f40543e7a7c4a675fb97f89e65aa020fbc009\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"1b197077f91bb8a7712d10ce1d20b4893f43812be17ba42bb4992071920e1700\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e87c5671fb7d586e5d1ac56b95f2895a3660735e0f6218be2c74be208934dcff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"eb444a73a234648c5da8f9071252a846b917013ba37c22d8650e9759fec31005\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"55b77a36ad6c7f1af559dd1c7e1c61fccbe10745a273f6da1fc83c7b113df344\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"aaf67797e583cde8da01b2d8b952d1256c3c429bee24e8cd88b2b53084d1c712\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad94934bef7002e6d043e62454d4634ace243fcb94fe18493e1d5f16b1f3bed9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"f83f172272f26e977da90def79fdec98548e01eb46b4a6b843fcf8a1d8a7969e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d53ed113ade160b6e78aabbb905b9967c95c87f900bcd7508e435075d49ef04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"cc4340a3b6aeeae490ba48b16f71e56d4ea58805a103990fe03cdb0b9c078df7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4960ec1dabe36ebc181f4cbc408770cf42c568ee0268ff071904ca6708f2dca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"35b51908264f06f5a6c6912231d66bcde3997b9506778f12289e03a97f768112\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b77a5e0afeb2be496e800a4794829b926c52c652770117aa5b0db362b0bdeafe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"4a80118befaf51dc37951b2d2384ce8f333187aa29cf6ee02ed8742b0b9d4e56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ad4c2008f2bcb23bed1eaab3ee0e8664a67c9296abb21de7134a35b26d400a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"41ff8895b121f6ffabe4b0141e2e3235498e697e268a70be670c77edaa7bc0f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a5d239b15e872fe93650a6717424803592cf65b7b48fc64854676a213c6dd6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"4eb6331e513406b95f64a2c41f596a89530baf91b344342d87182b2d763787c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"5dedc6dee45d1abee8c19f6f4c42fb55d06758b5fed0909cf21751bdfe9be5f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"980887992cc7e6c74980cf1fe4e50f09c0f06a300c9323cb555f8f0c45740837\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"92fc99421f6a2bb91b311a13d2db9c621790c803fde132892e7873aa4bc3675c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"967c3cc0acbbd5cbf744b398accf5c5e3d0d0e23659fc20e69ddc0bb3f0a8d96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"92303fb39cb3b4f32df939e72e4c266d891b1f7daac1e5e5697090cfdc30cc3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"26977b28a28ee3b9d2971b6c1c4c2e5d5eee6498d6da7bfb5d930fa3ef701b61\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"3345327cd54009ecfc38f389d5191486bc0d1c6b0c59593a6098c4fd05b46559\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-ad3cbc"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:17.525Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e87c5671fb7d586e5d1ac56b95f2895a3660735e0f6218be2c74be208934dcff","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e87c5671fb7d586e5d1ac56b95f2895a3660735e0f6218be2c74be208934dcff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e87c5671fb7d586e5d1ac56b95f2895a3660735e0f6218be2c74be208934dcff\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.600Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-209995#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e4e8e02b196ca1c53fef0d1ede240d3ff9dd97e2f72839485b25216ae9c2b908","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e4e8e02b196ca1c53fef0d1ede240d3ff9dd97e2f72839485b25216ae9c2b908"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e4e8e02b196ca1c53fef0d1ede240d3ff9dd97e2f72839485b25216ae9c2b908\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.674Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"26977b28a28ee3b9d2971b6c1c4c2e5d5eee6498d6da7bfb5d930fa3ef701b61","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["26977b28a28ee3b9d2971b6c1c4c2e5d5eee6498d6da7bfb5d930fa3ef701b61"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"26977b28a28ee3b9d2971b6c1c4c2e5d5eee6498d6da7bfb5d930fa3ef701b61\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.748Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b77a5e0afeb2be496e800a4794829b926c52c652770117aa5b0db362b0bdeafe","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b77a5e0afeb2be496e800a4794829b926c52c652770117aa5b0db362b0bdeafe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b77a5e0afeb2be496e800a4794829b926c52c652770117aa5b0db362b0bdeafe\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.833Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.912Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b076518fe7919b1938e36a5b319f40543e7a7c4a675fb97f89e65aa020fbc009","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b076518fe7919b1938e36a5b319f40543e7a7c4a675fb97f89e65aa020fbc009"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b076518fe7919b1938e36a5b319f40543e7a7c4a675fb97f89e65aa020fbc009\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:17.986Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-209995#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dfeb3a1229a4845149be0cf5bb83dfffad44001dd74628d8fd992f6d4ae85451","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dfeb3a1229a4845149be0cf5bb83dfffad44001dd74628d8fd992f6d4ae85451"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-209995.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dfeb3a1229a4845149be0cf5bb83dfffad44001dd74628d8fd992f6d4ae85451\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:18.058Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fdced85e7d18606f04f9395e95e53b677eb683995d773e98eaf2786a2c5c30d7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fdced85e7d18606f04f9395e95e53b677eb683995d773e98eaf2786a2c5c30d7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fdced85e7d18606f04f9395e95e53b677eb683995d773e98eaf2786a2c5c30d7\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:18.135Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"55b77a36ad6c7f1af559dd1c7e1c61fccbe10745a273f6da1fc83c7b113df344","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["55b77a36ad6c7f1af559dd1c7e1c61fccbe10745a273f6da1fc83c7b113df344"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"55b77a36ad6c7f1af559dd1c7e1c61fccbe10745a273f6da1fc83c7b113df344\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:18.209Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d53ed113ade160b6e78aabbb905b9967c95c87f900bcd7508e435075d49ef04","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d53ed113ade160b6e78aabbb905b9967c95c87f900bcd7508e435075d49ef04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d53ed113ade160b6e78aabbb905b9967c95c87f900bcd7508e435075d49ef04\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:18.265Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3ce8f607c4bc629c3b3966f5a198350498e348f0795c7cc6a760211336fe1659","error":"authconfigs.authorino.kuadrant.io \"3ce8f607c4bc629c3b3966f5a198350498e348f0795c7cc6a760211336fe1659\" not found"}
{"level":"error","ts":"2026-11-04T00:46:18.325Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d761a16b8ad848c0908b601d581924fe4a052083961984096f35e960928468a","error":"authconfigs.authorino.kuadrant.io \"7d761a16b8ad848c0908b601d581924fe4a052083961984096f35e960928468a\" not found"}
{"level":"error","ts":"2026-11-04T00:46:18.384Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a791692bb7ec32bfadd2b2942d70bd888f89e4f4966ba918549ce8b42b0fce5f","error":"authconfigs.authorino.kuadrant.io \"a791692bb7ec32bfadd2b2942d70bd888f89e4f4966ba918549ce8b42b0fce5f\" not found"}
{"level":"error","ts":"2026-11-04T00:46:18.395Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-autores-209995","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-autores-209995","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-autores-209995","uid":"5de0ac64-6b2e-4903-9c82-a65f4aa3de75"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f168f4583d712cb62b7566a86061d952d25e99fe65d89b3a15fac288156ed408\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"5477c0e723252e87c174f0370d88ee7a8b2729b2a3264021aa3561b932b1dcd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfeb3a1229a4845149be0cf5bb83dfffad44001dd74628d8fd992f6d4ae85451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"cee17e21f825edd6b68de555ae055bd8f17f3801151b5494bbbe4cb8db47f2c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e981097a6e87c87d16ffc9ff10c0cd68196322193707be75767ccbaf25856e09\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"c60f9576bbeff372fbf4954b089bc1bbe62276df7fe5cafccbb9c6d312ab06f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad176d6926415a8a987ba0a153c4e117e5515941e4f35997708103f0ac7c5322\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"a559e86116ee278a58a06da0b9889c1e53807745ea63918f040ffed192ad28e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5071fd796776da52e7d80bcaf6ad0b1bc9d2831030b0e7dd06f57fab7354a9bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"6450667a416f17e20e1a186937b67f5226ee13eedae6d182879bef298fa77d88\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e4e8e02b196ca1c53fef0d1ede240d3ff9dd97e2f72839485b25216ae9c2b908\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"e42fdf97641626766b92028d227101630829ba6e12682b172a77f2247be14ba1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-autores-209995"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-autores-209995\" already exists"}
{"level":"error","ts":"2026-11-04T00:46:18.438Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5cfd71e544e7041dfbca0725c980efdfe21ced58f716a9e72b3a3e16bff6fcbf","error":"authconfigs.authorino.kuadrant.io \"5cfd71e544e7041dfbca0725c980efdfe21ced58f716a9e72b3a3e16bff6fcbf\" not found"}
{"level":"error","ts":"2026-11-04T00:46:18.493Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e463b367aab7d1d01fefc9efcf2258d29075272540a9411d4a37be9b76bb22f8","error":"authconfigs.authorino.kuadrant.io \"e463b367aab7d1d01fefc9efcf2258d29075272540a9411d4a37be9b76bb22f8\" not found"}
{"level":"error","ts":"2026-11-04T00:46:18.548Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ad65ad705b5dcfed19abac8508c874741274d0b5ab20018f341b59a5cc775ba6","error":"authconfigs.authorino.kuadrant.io \"ad65ad705b5dcfed19abac8508c874741274d0b5ab20018f341b59a5cc775ba6\" not found"}
{"level":"error","ts":"2026-11-04T00:46:18.623Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-ad3cbc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-ad3cbc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:18.669Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:18.795Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:18.918Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:18.931Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-autores-209995-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-autores-209995-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:18.992Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.051Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.181Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-1c754c","namespace":"openshift-ingress","uid":"932b2fef-245a-4f37-b2f3-78a6fe778eec","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-1c754c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.305Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.366Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-autores-209995","namespace":"openshift-ingress","uid":"c0154ca2-bb90-4856-8f12-6a69b48cdca0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.490Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.549Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.608Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.667Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.727Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.788Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.847Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.906Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:19.965Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:20.026Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:20.087Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:20.146Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:46:20.146Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:20.146Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:46:20.254Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-ad3cbc-kserve-route","namespace":"ai-tenant-e2e-shared-a-w4-ad3cbc","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-ad3cbc-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:20.526Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-autores-209995","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:46:21.163Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-209995","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:46:28.681Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","EnvoyFilter","Limitador","HTTPRoute","Gateway","AuthPolicy","ConfigMap"],"eventTypes":{"create":21,"delete":9,"update":28}}
{"level":"info","ts":"2026-11-04T00:46:29.081Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:31.219Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:46:31.415Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:46:31.415Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:35.159Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:46:35.169Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:35.169Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:35.174Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:35.175Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:46:35.181Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:46:35.181Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:38.350Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:38.350Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:46:39.104Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-238db1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:46:46.723Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","Gateway","Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"create":1,"update":25}}
{"level":"info","ts":"2026-11-04T00:46:47.123Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:49.328Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:46:49.455Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:46:49.455Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:53.362Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:46:53.413Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:53.424Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:46:53.447Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:46:53.450Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:53.450Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:53.583Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:46:56.568Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:46:56.568Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:47:04Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","reconcileID":"11272e5e-558e-42d9-a530-3d032c4f91fb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:47:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:47:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:47:04Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:47:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:47:05Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:47:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","reconcileID":"11272e5e-558e-42d9-a530-3d032c4f91fb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-1c754c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:47:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-1c754c","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:47:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:47:05Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-1c754c\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:47:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:47:05.115Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","AuthConfig","Limitador","HTTPRoute","EnvoyFilter","ConfigMap"],"eventTypes":{"create":12,"update":25}}
{"level":"info","ts":"2026-11-04T00:47:05.412Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:07.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:47:07.734Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:47:07.734Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:47:11.847Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:47:11.848Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:11.856Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:47:11.862Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:11.862Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:47:11.863Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:47:11.963Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:47:11.963Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:47:13.563Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-1c754c-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-b-1c754c-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:47:14.738Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-1c754c","namespace":"openshift-ingress","uid":"932b2fef-245a-4f37-b2f3-78a6fe778eec","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-1c754c\" not found"}
{"level":"info","ts":"2026-11-04T00:47:15.115Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:15.116Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:47:15.172Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-1c754c","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-b-1c754c\" not found"}
{"level":"error","ts":"2026-11-04T00:47:15.678Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-209995","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:47:16.658Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-04T00:47:23.173Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:47:23.176Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:47:23.176Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:23.247Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:47:23.261Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:23.261Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:47:23.413Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:47:23.413Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:47:23.413Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:23.484Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:23.557Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:23.630Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:23.702Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:23.777Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:23.849Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:23.922Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:23.968Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-1c754c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:23Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"00f7755d-f779-4d65-81de-2869b7207695\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:23Z"}],"name":"kuadrant-e2e-praxis-b-1c754c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-1c754c","uid":"00f7755d-f779-4d65-81de-2869b7207695"}],"resourceVersion":"88019","uid":"3d5be45b-c2d9-4a8a-b4d9-accbf7a0efe1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edf8b07d6d790c65dee7efc076451be90096254d4f7aaf687d86ada4373f207c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"e8520a564dbcbfb0211a2e2a60cc2f853031fcce5ae49d58331a168312f5e0d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4212115f5775158988fd933ab792231c9545f0394df3f7133bda1a9176c29231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"a23ceed40a5e60149ce1ddbeac6216918e372911a8d5062688623e28d9622d73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"28136b18bbee787efaef4d90cd72a43d56ec4b35fbd3beaf6ce6f87ea4b90f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"bd6b311cce51bda97c9b3fac9d7660e9433aa053feab856823ef54189cf46b2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"49d6367122e8f685bf87ec38fdc01a6adfd0079c8ab5c726f450cdd0a258b9f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"6975b469fe62f5b5d4a43814eca3c96eee61a186c44c9f9c295457cf7325ff84\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1ba1fcd78b6f45236e7133c4c8a682fff5c8a90edf1c491c1a6c9f6fc59a8fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"debb8028c4ceded5ca3e7675182c9731030ddeb98cb58eb46f65c14af83317a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48d32f004a90987e2d112af753dfaee09d5de326bbf046cfc85875d3769d346b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-1c754c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__be6deb4e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-1c754c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-1c754c\"]}],\"name\":\"4329ccd0b44bbbb47d72145ed9594415aecad7df44f2952dc8c610cbd8c5bab4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-1c754c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-1c754c\" not found"}
{"level":"error","ts":"2026-11-04T00:47:23.996Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:24.067Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:24.144Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:24.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6\" already exists"}
{"level":"error","ts":"2026-11-04T00:47:24.360Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-e89576","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:43:52Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"921550b9-e248-45c0-b3dd-b3c75826bf69\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:43:52Z"}],"name":"kuadrant-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-e89576","uid":"921550b9-e248-45c0-b3dd-b3c75826bf69"}],"resourceVersion":"87287","uid":"d0208b1f-740f-4ca5-984a-09841be9a98b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"91f7a7053a21f517ab34a4b3f2950064eb9b7dcdc52c46b83e4d5208e252a2d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"d07b4c2ee86fea861f162f492bed1237c24fd9a5488f03e46f679decbad4180d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"57fa76217ad3dbc03d69aed811e176def2fe3e742903f9e94ee52f47d87408ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"f3b738e68b88a1e573178c458a218504e7723aa1d76e387a40dbd12f3f428f25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"728d9d2370648df2628f68f6f78af93338635166b5556ba8a40cd73684f218c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"d2f6a2c21f2cb295e96ce8fe47552b698566ab11eb6689c59e9a41c981f09705\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"e3f8064b2232a40f7ab6b13ce5ae8f654434585ba6c2c3017e2ec826931a2039\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"1b27255fa74c331158cbc80c48f67c27c6cc5f1d1668b25f81d80344d9d8377f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"3ea848ea7a28ccec66fa770b3af2452b6b0b907146017230150b4eb245cdf478\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"d87db5c44ec951543284c283780ad49608d5b656d9ca3c8fbdd1cd6aeae044d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"89f25bfa769a1ccae56a7308dd2222e2acf515931782f00da579a0232909f440\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"7af194dd2b2a0c46e1777d202fbb37304bde667be67ddedab9499a35c047e5c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"d905c78da0cdf5f478de32358c2ae4dca582c958378c3883302cfcacc6b9da7b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"37c1860e1e4e68930b60168d1b0d31a91986f7d6c3d255500ae73e690c83f305\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"3d0875e7d40a1006f6dc884ebf4c6e76c73bd4743b08b8c254a3978e60371ebd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"c9b6409d871df38dfc216c339dcdbdddc6957e188e5670fe8a2f2d9c0b4f20a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"f83aa8482d6e610c9510479b619d42f446d9007036f44659c74719a84e346dc3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"7e7b72bfb2fa2ea6ebd96ad65672c2491a36cd2c9af379efb21163d9027cc733\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"2104afad6813867295f0ed2aa30579d6f295321af446b9ff84541d5760eff2e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cbb2bfaa3f7807da810e5291128dafdf0ad6a95e35e1e8579ba5c146fe1b92b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"755a0cc7a588e772af9132fcda445bc892a59b574f2f7284b043f1d478444943\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cfbf9c267cd9cb7b63a74fd1748936a93876c7424601b821496ba7463c22e3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5b4bf640448cf71b6adb08f5416cb2f93badffbd5e65a485b88a5db0cb08b40c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"493cb8642d7cbb23499392f14e4d28be76ed3e633c56318221b47ff22efa9714\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"009cd1f683b207a3c2fdf7b320e247395f6d0b0c92eb99f299f7f9d322ed3374\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-e89576"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:47:24.905Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-1c754c-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-b-1c754c-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:47:25.819Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-1c754c","namespace":"openshift-ingress","uid":"932b2fef-245a-4f37-b2f3-78a6fe778eec","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-1c754c\" not found"}
{"level":"error","ts":"2026-11-04T00:47:25.920Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-e89576-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-e89576-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:47:25.988Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-238db1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-238db1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:47:26.430Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:26.431Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:47:26.682Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-209995","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:47:26.822Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-e89576-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-e89576-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:47:27.306Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-1c754c","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-b-1c754c\" not found"}
{"level":"info","ts":"2026-11-04T00:47:35.035Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","AuthConfig","AuthPolicy","Limitador","Gateway","EnvoyFilter","HTTPRoute","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"create":14,"delete":7,"update":8}}
{"level":"info","ts":"2026-11-04T00:47:35.352Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:35.372Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:38.523Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:47:38.963Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:47:39.134Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:47:39.357Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:47:39.357Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:47:43.024Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:43.031Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:47:43.024Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:47:43.036Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:47:43.039Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:43.039Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:47:43.238Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:47:46.264Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:46.264Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:47:54.852Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthConfig","AuthPolicy","Limitador","EnvoyFilter","HTTPRoute"],"eventTypes":{"create":12,"delete":6,"update":6}}
{"level":"info","ts":"2026-11-04T00:47:55.253Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:47:57.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:47:57.535Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:47:57.535Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:01.553Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:48:01.564Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:01.564Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:01.567Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:01.567Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:48:01.574Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:48:01.574Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:04.646Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:04.646Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:09.847Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap","Limitador"],"eventTypes":{"update":22}}
{"level":"info","ts":"2026-11-04T00:48:10.230Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:12.341Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:48:12.430Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:48:12.430Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:16.637Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:48:16.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:16.652Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:16.652Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:16.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:48:16.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:16.662Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:48:18.792Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-a4fac5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-a4fac5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:48:19.699Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:19.699Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:48:19.826Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:48:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","reconcileID":"4eb89de2-0f0f-4698-9035-caeb81f47423","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:48:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:48:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","reconcileID":"0a461fda-06aa-4afe-9ead-94330edc3d7c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:48:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:48:31.983Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","ConfigMap","TokenRateLimitPolicy","AuthPolicy","Kuadrant"],"eventTypes":{"create":3,"update":5}}
{"level":"info","ts":"2026-11-04T00:48:32.395Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:32.415Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:36.140Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:36.235Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:48:36.314Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:48:36.525Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:48:36.525Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:40.938Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:48:40.943Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:40.956Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:48:41.014Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:48:41.022Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:41.022Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:41.210Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:46.463Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:46.463Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:48:46.746Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-209995","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:48:48.035Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthPolicy","Kuadrant","Gateway"],"eventTypes":{"create":2,"update":2}}
{"level":"info","ts":"2026-11-04T00:48:48.239Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:48.259Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:51.849Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:48:51.854Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:52.129Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:48:52.158Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:48:52.158Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:56.663Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:48:56.667Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:56.675Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:48:56.675Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:48:56.675Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:48:56.675Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:48:56.725Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-e6c59a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w1-e6c59a","uid":"5ade722c-b227-4494-8769-73c06bb9dc7e"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w1-e6c59a"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-w1-e6c59a\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:56.726Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-e6c59a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w1-e6c59a","uid":"5ade722c-b227-4494-8769-73c06bb9dc7e"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w1-e6c59a"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-w1-e6c59a\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:56.788Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:56.827Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:48:56.827Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:48:56.862Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:56.929Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-4"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:41:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:56Z"}],"name":"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2","namespace":"kuadrant-system","resourceVersion":"84027","uid":"2c962c20-a86b-4942-82ac-412ef1bc6262"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:57.013Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"49e148bcf8f3bd2320a8439c08fcf37e06f12f8a4f69ec3c353f67550d3c27f0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["49e148bcf8f3bd2320a8439c08fcf37e06f12f8a4f69ec3c353f67550d3c27f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"49e148bcf8f3bd2320a8439c08fcf37e06f12f8a4f69ec3c353f67550d3c27f0\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:57.115Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:57.188Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1c61e0c8efed24f831d57a2f9d9eb6015ab04e5299d81a2404abddc94efeb7b6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1c61e0c8efed24f831d57a2f9d9eb6015ab04e5299d81a2404abddc94efeb7b6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1c61e0c8efed24f831d57a2f9d9eb6015ab04e5299d81a2404abddc94efeb7b6\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:57.258Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:59Z"}],"name":"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801","namespace":"kuadrant-system","resourceVersion":"88963","uid":"47f65a7b-03fb-41d9-8d6d-fda4567b5b69"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:57.329Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2ee206b9d197095d798d970d5a59ea79142db3a941b81c4d6df21ed9f2179023","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ee206b9d197095d798d970d5a59ea79142db3a941b81c4d6df21ed9f2179023"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2ee206b9d197095d798d970d5a59ea79142db3a941b81c4d6df21ed9f2179023\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:57.396Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-6"},"creationTimestamp":"2026-11-04T00:41:55Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:41:56Z"}],"name":"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec","namespace":"kuadrant-system","resourceVersion":"84011","uid":"c097874a-48ed-425f-982b-8374644feac3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:57.443Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-516871","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:58Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59262430-a65d-4fb9-8082-a5ebbf86b6f6\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"}],"name":"kuadrant-e2e-shared-b-w2-516871","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-516871","uid":"59262430-a65d-4fb9-8082-a5ebbf86b6f6"}],"resourceVersion":"88929","uid":"f7839c9e-8ba0-49f2-b1b3-fba72e0e34b1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"9f95746066d990c42937a8fde6359a2552e50daa27967be248fada4716bcdd86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"0646aac9ad09f46890b8f2bfcb899fa6b99244f16df481bd753d864a2afc5f90\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"dcac5b8041d1f0f6bc5037e8aa068e769232a883e756caab4d5b53bbd64b3852\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"d09b5f6bf44ada63939ebe5cc099b77efb8bec389c189ed49528e880f25388e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"277cec8d8e3602511bc056209377366037fc08e78c3a91f63bc7f829db29b1b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"49b4ea6d228c91fe1b8b2b38f6b2a6623061d5164c2031a57119dc2fa3661283\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"9cb7c12e66536a4daab20fe81bf757770a5745f6f78794b59b6e336d62beeb03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"1fe25fb253f097d5189a8ca583d1e1fb920cd2428458393cf4a5cc6a8cc93393\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"b0bdf1559fb724e46b834693961ac80012ba18b84f1f7e761830354d69b6c20f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7c935768e90db20277ece574a7f8dfd6f0c2b7b8e8cca8e566c776c658a0a1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"845121c70923519dba3cfdad1eba2b3af3e4ff0821e689fd5514dbb648d006d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"761bf797bcc200d116ffeb19a7e6853e812ba417d574cf6f957bdd3ea40d9e3d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6f4cf8bb0a13d953b6933a79a08e64b47ac3583869c5e380c20819ca412b7d4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c61e0c8efed24f831d57a2f9d9eb6015ab04e5299d81a2404abddc94efeb7b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"5a19d657435e3f74156bf71a1ef2940a801e11dd88beff9bb2cb1b59efacd85d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ee206b9d197095d798d970d5a59ea79142db3a941b81c4d6df21ed9f2179023\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"f584a124894bd1090b63b2743f32e87bfcfb632fe878570452e0e9531e17b6a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6420733e1d82ed35c0ae5322fe3c75e21a926c6b2b3c7aa2c3fc8609e6bf2b46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"091b2f1c1b22b01bb79345cbc6846c65e0d3a928aef47124e4b3d8ef8c275bf2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b922bdeb28ead1b13774ce102977c443fbdd7d138fff61a9345adb7435f0589c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"3d34199565ac71e609747ffb92469792feebcd3fdf905d67f9960df6eae7e52f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"02561b9b5f195122bef8a9bc77eb12bb907cafd2c32dffa369106309197b0615\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"db3546065575f4a543d3abcfc21c38102ae3242dd76d412103465dada7219e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461900dec749bf597c6108ea637f2c131e4d31226ff12ae3650b3d2628ee91a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"b386b309d2b93f103a3ab3e23cc7d5998bb8393794a30e8b2a7583ee1e876222\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cd8b7232e1f7de3fdf226b7dc817264d0cb9b607a92bbf3d050abc3a903053\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"9489c7d910e0dbf4d066ca58f896cc05e1b16910faa4308dcc6fe6097513168d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a5b336bf2774a6b44cb0093737fb0b86d5e26bb8c672aae4f9ae8f3456a5fea9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"d0383afbccf920cdc1f58f2141576b2a7578f2443cb2188b93412c17c8818f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6118ee007d06753619cdd3723e5f364a3646a3c9d99cd0e248a2b041cedc688e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"ae0c5d6228fd93a9b5aa81cf9c846a9343adbd4f82f7085a13f27f7d910fe0c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"93f6801119535020e051e319ff1814709e08eba59d41d11da398d6675db1d33b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"c43b20454038dbfa463db22fa3ec806267111d0d7471710a880d546f9c04b08c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6a5ce3b5e4931a7f21c9b99482f16a36f46eb3341d6754ac80a7a492496aaca3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"949c3ba0fa4e5ad6bb7ab3a9250d0df7228141042f873672e005fd77b67dcb3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"1a3aff9adf669cba66da7064a688240cd5795225e6d8837cbaca9dcf158740a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-516871"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:57.461Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:59Z"}],"name":"fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594","namespace":"kuadrant-system","resourceVersion":"88965","uid":"bcbee6a9-73f4-4403-92d0-6057968d36a8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:57.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-2"},"creationTimestamp":"2026-11-04T00:41:55Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:41:56Z"}],"name":"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d","namespace":"kuadrant-system","resourceVersion":"84008","uid":"ad017b8b-d2d9-4883-b9ff-12273ea4ce74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:57.597Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-3"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:41:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:56Z"}],"name":"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908","namespace":"kuadrant-system","resourceVersion":"84017","uid":"3b79844d-57b8-440a-a3bd-feecbc0c50c2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:57.670Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a5b336bf2774a6b44cb0093737fb0b86d5e26bb8c672aae4f9ae8f3456a5fea9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a5b336bf2774a6b44cb0093737fb0b86d5e26bb8c672aae4f9ae8f3456a5fea9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a5b336bf2774a6b44cb0093737fb0b86d5e26bb8c672aae4f9ae8f3456a5fea9\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:57.684Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-e6c59a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w1-e6c59a","uid":"5ade722c-b227-4494-8769-73c06bb9dc7e"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"314672513711dee5adf50319e2d21cf21916637b1af195669f8677efcd77cfdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"d93e0d81582ca025fa16280a90ed0053ccf4d3bfd0ad56d0c775a2a8f02804e7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69a5c4ae27dc8e859a4559f7ab87a64047c4bfc814feb1cad3797354fa1ec640\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"6a0d797d1227aea5a12ff538434df469ef05a7ee401db7c39bb0fa7ad123fc05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d510d6bf0d02874963a62f4afffe682ebeae86d1b80d2d425407ccc8c330178\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"347354855c1cdb5b67fa9f1d8a7f959defe6cae096340721398863336ae3ed34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"49e148bcf8f3bd2320a8439c08fcf37e06f12f8a4f69ec3c353f67550d3c27f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"c938cec593e991bc11fb1e3e7d118212dd2cb0dfc7e2c72afa98668a7d51f0ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"42536036e7512c2feb811866135cccb636f11d9d8e3893b6c36572e31a8f7ae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"4819524beeef438ba69edd6a29f6fd07038bd94a981aa7439997d5794bbe247c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9adcdbd5184b289f728f65383fd5d52ff78e1bc7d5611b2e6cf173973bdeead9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"ed40a51de12529d09ac83585257509f6204e9180065f98bcb699f8c7c0e8ed89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w1-e6c59a"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w1-e6c59a\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:57.736Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-1"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:41:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:56Z"}],"name":"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb","namespace":"kuadrant-system","resourceVersion":"84014","uid":"074658b5-7e74-475c-90a1-7c854767056e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:57.806Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"42536036e7512c2feb811866135cccb636f11d9d8e3893b6c36572e31a8f7ae6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["42536036e7512c2feb811866135cccb636f11d9d8e3893b6c36572e31a8f7ae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"42536036e7512c2feb811866135cccb636f11d9d8e3893b6c36572e31a8f7ae6\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:57.875Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:24Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4822deea-cfc7-4012-8bab-7aa664065e4f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:24Z"}],"name":"kuadrant-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}],"resourceVersion":"88043","uid":"2cb81ab4-d10b-47fd-8ee0-a5914960e25e"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"7172cb955c397212a8a237e97ddbe671d00b0b017de53501a9513b805f985107\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"efccb40cb53abdc75ef2e40cfbdef981590a57aff04818cc90e56ebd130e2c11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"046a2cd0858cfa37810137f11a437a8ab0544003b81ddf8be4949818e3ed026f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"7785967d3a5eea496ef51a2e5cb9772a765b47f865225741338cbbb7fb3389da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"8eeb6c660b878f1ddea428a94e56bdbdbdcba6a75b04f120fae1f900306548fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"16f0f4a6e4245b13c76e2c1bed11331390459226739647281f8d80c0acd7bcad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"679dc523d72fea0e84519fd988b527f7fc7b4b5450642f5a1fbd72a9e066b70e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"d3b69d056b08d543438987d3d0ebb995367297688c77ba7aaac789200b5b3cac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"a8145813a9b56dc34ed50dd81fc379ed19f75a26ecc67269c54fb433b09cd1a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"ac4fceaf94ac5d64795dff012fa45370b94ac89146a0acb81848a9c3ab906e0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"d1f5c82a994de0ca6fc045fedc02e93b2169e18e2d51e2856ee387646a4f47d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"61ebb24ad95a0fa5757c6af03d1afbf26eabefd7b28ddea80aa8719ed1b1cb60\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"4054017d551676f360ee2b85102ef7467a32145a267ee998ac1af417164a378c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"fe45d17f48183d340506e57f357c4e082d211bae83bfacaef49a97c4f8a0c766\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"9b42dee6e04c3405bfdd9c4d5aa535e96611261e9ee53a9453afde2cae291c38\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"394e3d3e513d394af7405819dda49a11aaeac0ae258a0de620d641bfedcac7e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"42a431282d55ae9a02dbe8b838187536c57be626dd90822696cf2176becad44f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"2bf7e63da88c6642991175fd5d4bc2414f8eaf985bbdc7398de47c231db6f66a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"f903e979a9c7e958a8ac8343abef701d933c76001e3754a7d6480dcbe4c9737a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"dbd867a3282f4d3f0b2224e9a0a717b6688c4853b976493add937469edc9dfb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"79016ee4b4f966cf6c441f34579ea049f63637553b8193324bae0aa836b2db7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"df2665493c1179abe9d1eb2a996b4ad965011d3b3e7e7451c8f64999ea7e5e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"c8cc7f1ee42f8704cc0aa6fe662e93eb76b065868d0b1ca19a262a9434302ebe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"37694e0fe4a8a4daee6cd09ea67587f3f90a67fba636fb5f0a92fd82ec0cf000\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"4b6b14b9d30c5543b67d2e66eb4a684ff00131454a07461140d489fc4cc6b68b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:57.876Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:57.947Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:58.019Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9adcdbd5184b289f728f65383fd5d52ff78e1bc7d5611b2e6cf173973bdeead9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9adcdbd5184b289f728f65383fd5d52ff78e1bc7d5611b2e6cf173973bdeead9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9adcdbd5184b289f728f65383fd5d52ff78e1bc7d5611b2e6cf173973bdeead9\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:58.089Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:58.160Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"02561b9b5f195122bef8a9bc77eb12bb907cafd2c32dffa369106309197b0615","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["02561b9b5f195122bef8a9bc77eb12bb907cafd2c32dffa369106309197b0615"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"02561b9b5f195122bef8a9bc77eb12bb907cafd2c32dffa369106309197b0615\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:58.234Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"314672513711dee5adf50319e2d21cf21916637b1af195669f8677efcd77cfdf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["314672513711dee5adf50319e2d21cf21916637b1af195669f8677efcd77cfdf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"314672513711dee5adf50319e2d21cf21916637b1af195669f8677efcd77cfdf\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:58.306Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:58.374Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:59Z"}],"name":"435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7","namespace":"kuadrant-system","resourceVersion":"88972","uid":"e6d65583-a5e0-4f31-b091-cbc70ba0887e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:58.442Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:45:00Z"}],"name":"01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156","namespace":"kuadrant-system","resourceVersion":"89139","uid":"0d04a869-6a6f-4d2a-afd6-8f0101895bfe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:58.508Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:44:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:58Z"}],"name":"c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309","namespace":"kuadrant-system","resourceVersion":"88924","uid":"6bbedca5-07f8-4236-afda-7bf9e983bfb2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:58.578Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d510d6bf0d02874963a62f4afffe682ebeae86d1b80d2d425407ccc8c330178","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d510d6bf0d02874963a62f4afffe682ebeae86d1b80d2d425407ccc8c330178"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d510d6bf0d02874963a62f4afffe682ebeae86d1b80d2d425407ccc8c330178\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:58.644Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:44:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:45:00Z"}],"name":"adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba","namespace":"kuadrant-system","resourceVersion":"89128","uid":"481ca9e5-e244-4879-aade-fe3406d4583b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:58.711Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:59Z"}],"name":"781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e","namespace":"kuadrant-system","resourceVersion":"88968","uid":"a47d1f8d-2424-4264-b99d-b05a71a80657"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:58.777Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"}],"name":"f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9","namespace":"kuadrant-system","resourceVersion":"88946","uid":"2278ca7a-9821-4124-a9d2-9cdde904ce24"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:58.848Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:58.918Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b922bdeb28ead1b13774ce102977c443fbdd7d138fff61a9345adb7435f0589c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b922bdeb28ead1b13774ce102977c443fbdd7d138fff61a9345adb7435f0589c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b922bdeb28ead1b13774ce102977c443fbdd7d138fff61a9345adb7435f0589c\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:58.984Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"}],"name":"45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243","namespace":"kuadrant-system","resourceVersion":"88942","uid":"e4dd1531-0c74-4314-8abd-c16626723bc6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:59.057Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.132Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6420733e1d82ed35c0ae5322fe3c75e21a926c6b2b3c7aa2c3fc8609e6bf2b46","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6420733e1d82ed35c0ae5322fe3c75e21a926c6b2b3c7aa2c3fc8609e6bf2b46"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6420733e1d82ed35c0ae5322fe3c75e21a926c6b2b3c7aa2c3fc8609e6bf2b46\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.203Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.276Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"949c3ba0fa4e5ad6bb7ab3a9250d0df7228141042f873672e005fd77b67dcb3c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["949c3ba0fa4e5ad6bb7ab3a9250d0df7228141042f873672e005fd77b67dcb3c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"949c3ba0fa4e5ad6bb7ab3a9250d0df7228141042f873672e005fd77b67dcb3c\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.346Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a7c935768e90db20277ece574a7f8dfd6f0c2b7b8e8cca8e566c776c658a0a1c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7c935768e90db20277ece574a7f8dfd6f0c2b7b8e8cca8e566c776c658a0a1c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a7c935768e90db20277ece574a7f8dfd6f0c2b7b8e8cca8e566c776c658a0a1c\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.418Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"461900dec749bf597c6108ea637f2c131e4d31226ff12ae3650b3d2628ee91a5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["461900dec749bf597c6108ea637f2c131e4d31226ff12ae3650b3d2628ee91a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"461900dec749bf597c6108ea637f2c131e4d31226ff12ae3650b3d2628ee91a5\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.484Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"}],"name":"c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26","namespace":"kuadrant-system","resourceVersion":"88960","uid":"933030d0-b6ab-4863-a262-b619df65831c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:59.557Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.630Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"69a5c4ae27dc8e859a4559f7ab87a64047c4bfc814feb1cad3797354fa1ec640","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["69a5c4ae27dc8e859a4559f7ab87a64047c4bfc814feb1cad3797354fa1ec640"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"69a5c4ae27dc8e859a4559f7ab87a64047c4bfc814feb1cad3797354fa1ec640\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.702Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.767Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-5"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:41:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:56Z"}],"name":"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac","namespace":"kuadrant-system","resourceVersion":"84020","uid":"8559c22c-05ea-48dd-8249-146f081a99e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:59.833Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:44:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:58Z"}],"name":"8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43","namespace":"kuadrant-system","resourceVersion":"88931","uid":"c33b66db-b418-4cd5-a4ba-5a5c397342da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:48:59.903Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"96cd8b7232e1f7de3fdf226b7dc817264d0cb9b607a92bbf3d050abc3a903053","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["96cd8b7232e1f7de3fdf226b7dc817264d0cb9b607a92bbf3d050abc3a903053"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"96cd8b7232e1f7de3fdf226b7dc817264d0cb9b607a92bbf3d050abc3a903053\" already exists"}
{"level":"error","ts":"2026-11-04T00:48:59.974Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c\" already exists"}
{"level":"error","ts":"2026-11-04T00:49:00.047Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"761bf797bcc200d116ffeb19a7e6853e812ba417d574cf6f957bdd3ea40d9e3d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["761bf797bcc200d116ffeb19a7e6853e812ba417d574cf6f957bdd3ea40d9e3d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"761bf797bcc200d116ffeb19a7e6853e812ba417d574cf6f957bdd3ea40d9e3d\" already exists"}
{"level":"error","ts":"2026-11-04T00:49:00.113Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:44:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:44:58Z"}],"name":"140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc","namespace":"kuadrant-system","resourceVersion":"88940","uid":"31955288-a3eb-4f7a-9be9-0bc8807fb638"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.174Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.234Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.258Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-238db1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-238db1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.293Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.352Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.411Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.578Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.638Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.669Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-ad3cbc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-ad3cbc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.697Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.738Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-a4fac5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-a4fac5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.756Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.805Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-e6c59a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w1-e6c59a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.815Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.874Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:00.994Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.053Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.103Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-516871-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-516871-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.174Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.233Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress","uid":"bdb28298-f8ad-43b5-9aa4-51c38ea3fda9","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.244Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-d48ff4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-d48ff4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.355Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.476Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.535Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-autores-209995","namespace":"openshift-ingress","uid":"c0154ca2-bb90-4856-8f12-6a69b48cdca0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.656Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:01.716Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:49:01.718Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:01.718Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:49:02.031Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w1-e6c59a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:02.202Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-d48ff4-kserve-route","namespace":"ai-tenant-e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-d48ff4-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:02.295Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-516871-kserve-route","namespace":"ai-tenant-e2e-shared-b-w2-516871","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-516871-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:02.417Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-w1-e6c59a","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:49:02.434Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-209995","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-autores-209995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:49:10.674Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","Limitador","Gateway","EnvoyFilter","ConfigMap","HTTPRoute"],"eventTypes":{"create":33,"delete":1,"update":53}}
{"level":"info","ts":"2026-11-04T00:49:11.085Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:14.018Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:49:14.152Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:49:14.152Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:49:18.675Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:49:18.676Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:18.714Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:49:18.726Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:18.726Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:49:18.727Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:49:18.916Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:49:24.129Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:24.129Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:49:37.241Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","AuthConfig","TokenRateLimitPolicy","Limitador","EnvoyFilter","ConfigMap"],"eventTypes":{"delete":12,"update":46}}
{"level":"info","ts":"2026-11-04T00:49:37.544Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:40.356Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:49:40.514Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:49:40.514Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:49:45.861Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:45.869Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:49:45.878Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:45.878Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:49:45.861Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:49:45.914Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:49:46.030Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:49:46.030Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:49:49.415Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:49.415Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:49:51.145Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway"],"eventTypes":{"create":2}}
{"level":"info","ts":"2026-11-04T00:49:52Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","reconcileID":"479e8937-3682-4085-90f6-687fb4d8f4fe","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:49:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:49:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:49:52Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:49:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:49:53Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:49:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","reconcileID":"479e8937-3682-4085-90f6-687fb4d8f4fe","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-autores-209995","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:49:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-209995","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:49:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:49:53Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-autores-209995\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:49:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:49:58.572Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:49:58.613Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:58.614Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:49:58.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:49:58.634Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:49:58.634Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:49:58.734Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:49:58.734Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:50:00.012Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w3-a4fac5","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:41:56Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"0d9286a3-fc07-43a3-ae3f-1766edb49dd0\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:44:58Z"}],"name":"kuadrant-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w3-a4fac5","uid":"0d9286a3-fc07-43a3-ae3f-1766edb49dd0"}],"resourceVersion":"88937","uid":"b07661a3-d588-443c-b547-70c1165efbf4"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"1430a5f7cebb9d77677f183f65da9337d152a48bfafe3d37cfcd270307c7df9e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"55b91b030f20771875d8f6034586faa2db4fbc70eb10fb8d132882c15d0afaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"a81d3eff92e27ea5f5cac2db6fb0cf1a069bd951f29c48d484e8112db696880b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"d1c07ab63c7120efa7dccc42f9baaadb433c223ccbd44f804d37690d09425337\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"35a8564f19c1b3aa575d12e397fea0f23fdcdb16ef009f7564dc7ef4be46ee1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"cdfcd2d814c040588e2b1d88d65f9904cb2634712e56955e87a10b0a9a284568\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"108afa169d39fac08de3bfac4f917f03a000504129040f5dc69a2cf196d15bef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"618a90afaf2ea3c705eeac6f41eeabe561b7901fd9147e2071041c6dbb9db9d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"d21a8dbe4d63c1c76c5803889f0ed2b730249d1b48deb712d825daaa4657aaa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"a79d526802843d064aaa2681f2c6d0f890771839ea1eac1556af53e244c7789c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"bfa2ba133701eb0e4e8b1d9e8cff1c70e4152f4531e4bed579458e3897adac39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"dd07a42cbcc7b6ddb89e0ec031168dc4efd39f5fa2d09a3fb842bc0e8b36cee5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"58b33325da28633c2008f7546fee7584b31d404a57cae8a513b38540583b99d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"87e211399dd3bc3d5c1c424239aeb9399f8d04930fa1354a47995f4ae7147493\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"117cdacbdcc2d37da88ad7414ee2519e9ea13a4a30beef73141dcf36a5e4e8a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"a18b0cb0515a2d7f89035cc7abe4cf8dc535d97184538512401ebe29a6152281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"e259fd19a243470b41846cb89513e1f971b70d69b06abaa114e30229c21f4476\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"420f7a9f443a7dc911301904acf52fe84803c60cc435cd53fbfc3c99510d0259\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"0e76def713d30875a17e15c7a8c10c6ffd261a73e93b981aa4748f08f77984ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"c9acea04cbf39f2981dd1a245f18178f137cd6d2d7a643adbca92f59a142c153\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"e1d0e1b4476a1281d74748638e5802057df5161cf75b5267cf760ed1152999d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"340368d8ddc2b2ef6abd4fa7792745eac63d8424a90ecb186cc80096c6eb39ef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"1a7c82c7f9d0780636e05434bdf6e53e13e198a50a23623c5f9f6466c79dcea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"15031e7a1557e38e5db1b74edd83508a08c14602d4fdcd67811e608dfee97daa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc9268c0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"87da6a4038242cc4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-a4fac5/maas-trlp-auth-test-model-a4fac5\"]}],\"name\":\"0469aa6ed59e67d28f54962ab8e4029c4dfea8f6a9d9fa9b5071633d22937209\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w3-a4fac5"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:50:00.125Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-autores-209995","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:46:06Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5de0ac64-6b2e-4903-9c82-a65f4aa3de75\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:19Z"}],"name":"kuadrant-e2e-autores-209995","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-autores-209995","uid":"5de0ac64-6b2e-4903-9c82-a65f4aa3de75"}],"resourceVersion":"95358","uid":"e6a37085-a496-4c90-938e-0ea2a772d922"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f168f4583d712cb62b7566a86061d952d25e99fe65d89b3a15fac288156ed408\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"5477c0e723252e87c174f0370d88ee7a8b2729b2a3264021aa3561b932b1dcd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfeb3a1229a4845149be0cf5bb83dfffad44001dd74628d8fd992f6d4ae85451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"cee17e21f825edd6b68de555ae055bd8f17f3801151b5494bbbe4cb8db47f2c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e981097a6e87c87d16ffc9ff10c0cd68196322193707be75767ccbaf25856e09\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"c60f9576bbeff372fbf4954b089bc1bbe62276df7fe5cafccbb9c6d312ab06f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad176d6926415a8a987ba0a153c4e117e5515941e4f35997708103f0ac7c5322\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"a559e86116ee278a58a06da0b9889c1e53807745ea63918f040ffed192ad28e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5071fd796776da52e7d80bcaf6ad0b1bc9d2831030b0e7dd06f57fab7354a9bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"6450667a416f17e20e1a186937b67f5226ee13eedae6d182879bef298fa77d88\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e4e8e02b196ca1c53fef0d1ede240d3ff9dd97e2f72839485b25216ae9c2b908\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-209995-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a74b79bd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-209995\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-209995\"]}],\"name\":\"e42fdf97641626766b92028d227101630829ba6e12682b172a77f2247be14ba1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-autores-209995"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-autores-209995\" not found"}
{"level":"error","ts":"2026-11-04T00:50:00.476Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-e89576-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-e89576-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:50:00.588Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-autores-209995","namespace":"openshift-ingress","uid":"c0154ca2-bb90-4856-8f12-6a69b48cdca0","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-autores-209995\" not found"}
{"level":"error","ts":"2026-11-04T00:50:00.708Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:50:00.861Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-238db1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-238db1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:50:00.932Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-ad3cbc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-ad3cbc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:50:01.030Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-a4fac5","namespace":"ai-tenant-e2e-shared-a-w3-a4fac5","uid":"5d3f3505-7db0-4d17-b86b-148627408119","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:50:01.219Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-autores-209995-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-autores-209995-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T00:50:02.081Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:02.081Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:50:02.428Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-209995","error":"gateways.gateway.networking.k8s.io \"e2e-autores-209995\" not found"}
{"level":"error","ts":"2026-11-04T00:50:02.601Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-a4fac5-kserve-route","namespace":"ai-tenant-e2e-shared-a-w3-a4fac5","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-a4fac5-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:50:11.114Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","HTTPRoute","Gateway","EnvoyFilter","Kuadrant","ConfigMap","Limitador"],"eventTypes":{"create":3,"delete":7,"update":10}}
{"level":"info","ts":"2026-11-04T00:50:11.421Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:11.441Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:15.138Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:15.245Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:50:15.358Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:50:15.520Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:50:15.520Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:19.849Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:50:19.856Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:19.930Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:50:19.935Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:50:19.940Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:19.940Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:20.087Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:23.584Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:23.584Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:32.526Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthConfig","TokenRateLimitPolicy","ConfigMap","Limitador","AuthPolicy","EnvoyFilter"],"eventTypes":{"delete":6,"update":31}}
{"level":"info","ts":"2026-11-04T00:50:32.876Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:35.031Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:50:35.329Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:50:35.329Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:39.381Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:50:39.385Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:39.414Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:50:39.417Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:39.417Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:39.421Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:50:39.421Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:44Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","reconcileID":"c8dca9ae-f153-4738-aace-d8be8ab3538f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:50:44.177Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:44.177Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:50:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:50:44.533Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w1-7cdb6d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w1-7cdb6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:50:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:50:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:50:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:50:44Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","reconcileID":"36e6bd00-5dcc-41c9-9d39-81fb45287bf0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:50:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:50:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:50:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:50:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:50:45Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:50:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:50:53.027Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","Kuadrant","AuthPolicy","HTTPRoute","Gateway","ConfigMap","Limitador"],"eventTypes":{"create":3,"update":62}}
{"level":"info","ts":"2026-11-04T00:50:53.420Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:53.424Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:50:57.453Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:50:57.841Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:50:57.935Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:50:58.127Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:50:58.127Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:01.967Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:51:02.013Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:02.021Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:51:02.028Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:51:02.038Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:02.038Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:02.187Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:05.465Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:05.465Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:11Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-ec8706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-ec8706","reconcileID":"00f74a27-a643-4232-b986-672cdf79348a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-explicit-ec8706","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:51:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-ec8706","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:51:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-ec8706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-ec8706","reconcileID":"d5e72a9d-c614-44f1-b710-78b2582390e8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-explicit-ec8706","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-ec8706","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:51:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:51:19.427Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","EnvoyFilter","AuthPolicy","Gateway","ConfigMap","Limitador","HTTPRoute"],"eventTypes":{"create":10,"update":27}}
{"level":"info","ts":"2026-11-04T00:51:19.842Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:22.646Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:51:22.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:51:22.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:27.512Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:51:27.527Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:51:27.529Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:27.534Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:27.534Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:27.540Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:51:27.766Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:51:27.766Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:31.626Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:31.626Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:33.387Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","HTTPRoute","Kuadrant","Gateway"],"eventTypes":{"create":5,"update":2}}
{"level":"info","ts":"2026-11-04T00:51:33.643Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:33.663Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:38.048Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:51:38.056Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:38.130Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:51:38.131Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:51:38.131Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:51:42.960Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:51:42.967Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:43.014Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:51:43.021Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:51:43.023Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-explicit-ec8706","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-explicit-ec8706","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-explicit-ec8706","uid":"9de46be4-1c46-4dcf-b89f-236401156a4d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-explicit-ec8706"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-explicit-ec8706\" already exists"}
{"level":"info","ts":"2026-11-04T00:51:43.023Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:43.023Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:51:43.024Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-explicit-ec8706","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-explicit-ec8706","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-explicit-ec8706","uid":"9de46be4-1c46-4dcf-b89f-236401156a4d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-explicit-ec8706"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-explicit-ec8706\" already exists"}
{"level":"error","ts":"2026-11-04T00:51:43.088Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a9e5e5c3e33e6b069e3fd19f80678aff8bd9d116961ee191667852b526ab2db9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9e5e5c3e33e6b069e3fd19f80678aff8bd9d116961ee191667852b526ab2db9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a9e5e5c3e33e6b069e3fd19f80678aff8bd9d116961ee191667852b526ab2db9\" already exists"}
{"level":"error","ts":"2026-11-04T00:51:43.126Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:51:43.126Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:51:43.163Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f6e048e2ecee6ac10c99fdc9a31534fdc402a79e067941b75e9750b865de652d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6e048e2ecee6ac10c99fdc9a31534fdc402a79e067941b75e9750b865de652d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f6e048e2ecee6ac10c99fdc9a31534fdc402a79e067941b75e9750b865de652d\" already exists"}
{"level":"error","ts":"2026-11-04T00:51:43.245Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ab5bb0cfb81154b798eaf490b2f896a5995086707b07f4748895928cac7f1ece","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab5bb0cfb81154b798eaf490b2f896a5995086707b07f4748895928cac7f1ece"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ab5bb0cfb81154b798eaf490b2f896a5995086707b07f4748895928cac7f1ece\" already exists"}
{"level":"error","ts":"2026-11-04T00:51:43.433Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"612a9aabc0c5b31455e44266231373cfb3f5a1438e7bc56095e1945323f58e33","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["612a9aabc0c5b31455e44266231373cfb3f5a1438e7bc56095e1945323f58e33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"612a9aabc0c5b31455e44266231373cfb3f5a1438e7bc56095e1945323f58e33\" already exists"}
{"level":"error","ts":"2026-11-04T00:51:43.524Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"407c5ea84515eda2bf78294f9bed97e20983083f4acffb449341e9b757ff7aef","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["407c5ea84515eda2bf78294f9bed97e20983083f4acffb449341e9b757ff7aef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"407c5ea84515eda2bf78294f9bed97e20983083f4acffb449341e9b757ff7aef\" already exists"}
{"level":"error","ts":"2026-11-04T00:51:43.606Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fc8f8f8a560747bb19af795914cb6f2435df5d76e0bf0fd7fe76ffa5c9c7ad95","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fc8f8f8a560747bb19af795914cb6f2435df5d76e0bf0fd7fe76ffa5c9c7ad95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-explicit-ec8706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fc8f8f8a560747bb19af795914cb6f2435df5d76e0bf0fd7fe76ffa5c9c7ad95\" already exists"}
{"level":"error","ts":"2026-11-04T00:51:43.714Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:24Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4822deea-cfc7-4012-8bab-7aa664065e4f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:42Z"}],"name":"kuadrant-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}],"resourceVersion":"94641","uid":"2cb81ab4-d10b-47fd-8ee0-a5914960e25e"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"7172cb955c397212a8a237e97ddbe671d00b0b017de53501a9513b805f985107\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"efccb40cb53abdc75ef2e40cfbdef981590a57aff04818cc90e56ebd130e2c11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"046a2cd0858cfa37810137f11a437a8ab0544003b81ddf8be4949818e3ed026f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"7785967d3a5eea496ef51a2e5cb9772a765b47f865225741338cbbb7fb3389da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"8eeb6c660b878f1ddea428a94e56bdbdbdcba6a75b04f120fae1f900306548fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"16f0f4a6e4245b13c76e2c1bed11331390459226739647281f8d80c0acd7bcad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"679dc523d72fea0e84519fd988b527f7fc7b4b5450642f5a1fbd72a9e066b70e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"d3b69d056b08d543438987d3d0ebb995367297688c77ba7aaac789200b5b3cac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"a8145813a9b56dc34ed50dd81fc379ed19f75a26ecc67269c54fb433b09cd1a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"ac4fceaf94ac5d64795dff012fa45370b94ac89146a0acb81848a9c3ab906e0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"d1f5c82a994de0ca6fc045fedc02e93b2169e18e2d51e2856ee387646a4f47d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"61ebb24ad95a0fa5757c6af03d1afbf26eabefd7b28ddea80aa8719ed1b1cb60\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"4054017d551676f360ee2b85102ef7467a32145a267ee998ac1af417164a378c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"fe45d17f48183d340506e57f357c4e082d211bae83bfacaef49a97c4f8a0c766\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"9b42dee6e04c3405bfdd9c4d5aa535e96611261e9ee53a9453afde2cae291c38\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"394e3d3e513d394af7405819dda49a11aaeac0ae258a0de620d641bfedcac7e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"42a431282d55ae9a02dbe8b838187536c57be626dd90822696cf2176becad44f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"2bf7e63da88c6642991175fd5d4bc2414f8eaf985bbdc7398de47c231db6f66a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"f903e979a9c7e958a8ac8343abef701d933c76001e3754a7d6480dcbe4c9737a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"dbd867a3282f4d3f0b2224e9a0a717b6688c4853b976493add937469edc9dfb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"79016ee4b4f966cf6c441f34579ea049f63637553b8193324bae0aa836b2db7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"df2665493c1179abe9d1eb2a996b4ad965011d3b3e7e7451c8f64999ea7e5e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"c8cc7f1ee42f8704cc0aa6fe662e93eb76b065868d0b1ca19a262a9434302ebe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"37694e0fe4a8a4daee6cd09ea67587f3f90a67fba636fb5f0a92fd82ec0cf000\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__6d88de7d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4747d93bda1897ba\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-auth-test-model-d48ff4\"]}],\"name\":\"4b6b14b9d30c5543b67d2e66eb4a684ff00131454a07461140d489fc4cc6b68b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:43.840Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-516871","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:58Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59262430-a65d-4fb9-8082-a5ebbf86b6f6\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:41Z"}],"name":"kuadrant-e2e-shared-b-w2-516871","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-516871","uid":"59262430-a65d-4fb9-8082-a5ebbf86b6f6"}],"resourceVersion":"94606","uid":"f7839c9e-8ba0-49f2-b1b3-fba72e0e34b1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"9f95746066d990c42937a8fde6359a2552e50daa27967be248fada4716bcdd86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"0646aac9ad09f46890b8f2bfcb899fa6b99244f16df481bd753d864a2afc5f90\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"dcac5b8041d1f0f6bc5037e8aa068e769232a883e756caab4d5b53bbd64b3852\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"d09b5f6bf44ada63939ebe5cc099b77efb8bec389c189ed49528e880f25388e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"277cec8d8e3602511bc056209377366037fc08e78c3a91f63bc7f829db29b1b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"49b4ea6d228c91fe1b8b2b38f6b2a6623061d5164c2031a57119dc2fa3661283\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"9cb7c12e66536a4daab20fe81bf757770a5745f6f78794b59b6e336d62beeb03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"1fe25fb253f097d5189a8ca583d1e1fb920cd2428458393cf4a5cc6a8cc93393\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"b0bdf1559fb724e46b834693961ac80012ba18b84f1f7e761830354d69b6c20f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7c935768e90db20277ece574a7f8dfd6f0c2b7b8e8cca8e566c776c658a0a1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"845121c70923519dba3cfdad1eba2b3af3e4ff0821e689fd5514dbb648d006d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"761bf797bcc200d116ffeb19a7e6853e812ba417d574cf6f957bdd3ea40d9e3d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"6f4cf8bb0a13d953b6933a79a08e64b47ac3583869c5e380c20819ca412b7d4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c61e0c8efed24f831d57a2f9d9eb6015ab04e5299d81a2404abddc94efeb7b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"5a19d657435e3f74156bf71a1ef2940a801e11dd88beff9bb2cb1b59efacd85d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ee206b9d197095d798d970d5a59ea79142db3a941b81c4d6df21ed9f2179023\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"f584a124894bd1090b63b2743f32e87bfcfb632fe878570452e0e9531e17b6a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6420733e1d82ed35c0ae5322fe3c75e21a926c6b2b3c7aa2c3fc8609e6bf2b46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"091b2f1c1b22b01bb79345cbc6846c65e0d3a928aef47124e4b3d8ef8c275bf2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b922bdeb28ead1b13774ce102977c443fbdd7d138fff61a9345adb7435f0589c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"3d34199565ac71e609747ffb92469792feebcd3fdf905d67f9960df6eae7e52f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"02561b9b5f195122bef8a9bc77eb12bb907cafd2c32dffa369106309197b0615\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"db3546065575f4a543d3abcfc21c38102ae3242dd76d412103465dada7219e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461900dec749bf597c6108ea637f2c131e4d31226ff12ae3650b3d2628ee91a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"b386b309d2b93f103a3ab3e23cc7d5998bb8393794a30e8b2a7583ee1e876222\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cd8b7232e1f7de3fdf226b7dc817264d0cb9b607a92bbf3d050abc3a903053\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"9489c7d910e0dbf4d066ca58f896cc05e1b16910faa4308dcc6fe6097513168d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a5b336bf2774a6b44cb0093737fb0b86d5e26bb8c672aae4f9ae8f3456a5fea9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"d0383afbccf920cdc1f58f2141576b2a7578f2443cb2188b93412c17c8818f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6118ee007d06753619cdd3723e5f364a3646a3c9d99cd0e248a2b041cedc688e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"ae0c5d6228fd93a9b5aa81cf9c846a9343adbd4f82f7085a13f27f7d910fe0c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"93f6801119535020e051e319ff1814709e08eba59d41d11da398d6675db1d33b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"c43b20454038dbfa463db22fa3ec806267111d0d7471710a880d546f9c04b08c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6a5ce3b5e4931a7f21c9b99482f16a36f46eb3341d6754ac80a7a492496aaca3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"949c3ba0fa4e5ad6bb7ab3a9250d0df7228141042f873672e005fd77b67dcb3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8747c969\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1a54bc1e32321f5e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w2-516871/maas-trlp-auth-test-model-516871\"]}],\"name\":\"1a3aff9adf669cba66da7064a688240cd5795225e6d8837cbaca9dcf158740a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-516871"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:43.991Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-explicit-ec8706","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-explicit-ec8706","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-explicit-ec8706","uid":"9de46be4-1c46-4dcf-b89f-236401156a4d"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab5bb0cfb81154b798eaf490b2f896a5995086707b07f4748895928cac7f1ece\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-ec8706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]}],\"name\":\"56bf898e33557de9e88302d7abf54ef9da50865fa8ff7d98ca4115a734831e44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"612a9aabc0c5b31455e44266231373cfb3f5a1438e7bc56095e1945323f58e33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-ec8706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]}],\"name\":\"1416bd31f0fa0c7c8ea9594efbc204fdf6790cae1fc889bf45467e7dd55fc144\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9e5e5c3e33e6b069e3fd19f80678aff8bd9d116961ee191667852b526ab2db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-ec8706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]}],\"name\":\"90a6a5d662bfcb4797eb3444beb321b14d22cf159a1ce67717b5d19370c467f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6e048e2ecee6ac10c99fdc9a31534fdc402a79e067941b75e9750b865de652d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-ec8706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]}],\"name\":\"274c6b46072b713d414621c639833276f809e267196bc74b3a8e32547f9396ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"407c5ea84515eda2bf78294f9bed97e20983083f4acffb449341e9b757ff7aef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-ec8706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]}],\"name\":\"ea9b0b87ce321410f072daa081670382d71f6ae40bfd37de6472c3e62b9ef2bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8f8f8a560747bb19af795914cb6f2435df5d76e0bf0fd7fe76ffa5c9c7ad95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-ec8706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__71983bb4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-ec8706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-ec8706\"]}],\"name\":\"474096975dfa0a3d7633d8f6ee572477ec9405e9e4fa140e8f17718a6bba8baa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-explicit-ec8706"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-explicit-ec8706\" already exists"}
{"level":"error","ts":"2026-11-04T00:51:44.286Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-e89576","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:43:52Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"921550b9-e248-45c0-b3dd-b3c75826bf69\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:47:13Z"}],"name":"kuadrant-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-e89576","uid":"921550b9-e248-45c0-b3dd-b3c75826bf69"}],"resourceVersion":"92865","uid":"d0208b1f-740f-4ca5-984a-09841be9a98b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"91f7a7053a21f517ab34a4b3f2950064eb9b7dcdc52c46b83e4d5208e252a2d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"d07b4c2ee86fea861f162f492bed1237c24fd9a5488f03e46f679decbad4180d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"57fa76217ad3dbc03d69aed811e176def2fe3e742903f9e94ee52f47d87408ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"f3b738e68b88a1e573178c458a218504e7723aa1d76e387a40dbd12f3f428f25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"728d9d2370648df2628f68f6f78af93338635166b5556ba8a40cd73684f218c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"d2f6a2c21f2cb295e96ce8fe47552b698566ab11eb6689c59e9a41c981f09705\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"e3f8064b2232a40f7ab6b13ce5ae8f654434585ba6c2c3017e2ec826931a2039\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"1b27255fa74c331158cbc80c48f67c27c6cc5f1d1668b25f81d80344d9d8377f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"3ea848ea7a28ccec66fa770b3af2452b6b0b907146017230150b4eb245cdf478\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"d87db5c44ec951543284c283780ad49608d5b656d9ca3c8fbdd1cd6aeae044d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"89f25bfa769a1ccae56a7308dd2222e2acf515931782f00da579a0232909f440\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"7af194dd2b2a0c46e1777d202fbb37304bde667be67ddedab9499a35c047e5c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"d905c78da0cdf5f478de32358c2ae4dca582c958378c3883302cfcacc6b9da7b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"37c1860e1e4e68930b60168d1b0d31a91986f7d6c3d255500ae73e690c83f305\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"3d0875e7d40a1006f6dc884ebf4c6e76c73bd4743b08b8c254a3978e60371ebd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"c9b6409d871df38dfc216c339dcdbdddc6957e188e5670fe8a2f2d9c0b4f20a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"f83aa8482d6e610c9510479b619d42f446d9007036f44659c74719a84e346dc3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"7e7b72bfb2fa2ea6ebd96ad65672c2491a36cd2c9af379efb21163d9027cc733\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"2104afad6813867295f0ed2aa30579d6f295321af446b9ff84541d5760eff2e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cbb2bfaa3f7807da810e5291128dafdf0ad6a95e35e1e8579ba5c146fe1b92b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"755a0cc7a588e772af9132fcda445bc892a59b574f2f7284b043f1d478444943\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cfbf9c267cd9cb7b63a74fd1748936a93876c7424601b821496ba7463c22e3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5b4bf640448cf71b6adb08f5416cb2f93badffbd5e65a485b88a5db0cb08b40c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"493cb8642d7cbb23499392f14e4d28be76ed3e633c56318221b47ff22efa9714\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__7b1b86e0\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"83ed33ea7d1fbcd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-e89576/maas-trlp-auth-test-model-e89576\"]}],\"name\":\"009cd1f683b207a3c2fdf7b320e247395f6d0b0c92eb99f299f7f9d322ed3374\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-e89576"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:44.934Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-e89576","namespace":"ai-tenant-e2e-shared-b-w3-e89576","uid":"4be1dc0f-73ba-4ba4-82f5-40161770248f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:45.213Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-explicit-ec8706-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-explicit-ec8706-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:45.376Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-a4fac5","namespace":"ai-tenant-e2e-shared-a-w3-a4fac5","uid":"5d3f3505-7db0-4d17-b86b-148627408119","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-a4fac5\" not found"}
{"level":"error","ts":"2026-11-04T00:51:45.436Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-ad3cbc","namespace":"ai-tenant-e2e-shared-a-w4-ad3cbc","uid":"c8c73ecf-52c6-4048-9ad2-d1edd9d31179","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-ad3cbc\" not found"}
{"level":"error","ts":"2026-11-04T00:51:45.442Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w1-7cdb6d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w1-7cdb6d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:45.998Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:46.181Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:46.240Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-explicit-ec8706","namespace":"openshift-ingress","uid":"ad0c50c8-29c2-4440-b9c3-ade50ba1eb1b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-explicit-ec8706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:46.300Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress","uid":"8ee23743-8136-414a-befd-4823f1204662","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w1-7cdb6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:46.359Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:46.610Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-d48ff4","namespace":"ai-tenant-e2e-shared-b-w4-d48ff4","uid":"ac886783-31f3-4063-8db0-2e8b83332954","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:46.917Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-516871","namespace":"ai-tenant-e2e-shared-b-w2-516871","uid":"9dcc31fe-a408-4354-af4e-4d742ed94ac2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:51:46.917Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:51:46.918Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:51:47.199Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-explicit-ec8706","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-explicit-ec8706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:47.401Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-d48ff4-kserve-route","namespace":"ai-tenant-e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-d48ff4-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:47.527Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-516871-kserve-route","namespace":"ai-tenant-e2e-shared-b-w2-516871","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-516871-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:47.613Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-e89576-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-e89576-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:51:48.019Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-ec8706","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-ec8706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:51:59.865Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthConfig","EnvoyFilter","AuthPolicy","TokenRateLimitPolicy","Limitador","ConfigMap","Gateway"],"eventTypes":{"create":9,"delete":3,"update":20}}
{"level":"info","ts":"2026-11-04T00:52:00.274Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:03.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:52:03.440Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:52:03.440Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:52:07.922Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:52:07.927Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:07.933Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:07.933Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:52:07.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:52:07.939Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:52:08.158Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:52:14.349Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-516871-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-516871-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:14.958Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-238db1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-238db1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:52:15.639Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:15.639Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:52:15.755Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-e89576-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-e89576","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-e89576-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T00:52:15.925Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-ad3cbc-kserve-route","namespace":"ai-tenant-e2e-shared-a-w4-ad3cbc","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-ad3cbc-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T00:52:16.014Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w1-e6c59a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:16.090Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-a4fac5-kserve-route","namespace":"ai-tenant-e2e-shared-a-w3-a4fac5","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-a4fac5-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T00:52:16.142Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-ad3cbc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:16.268Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-238db1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:16.480Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-a4fac5","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:16.525Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-238db1-kserve-route","namespace":"ai-tenant-e2e-shared-a-w2-238db1","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-238db1-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T00:52:16.607Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:52:17.287Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"delete":3,"update":4}}
{"level":"info","ts":"2026-11-04T00:52:25.176Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:52:25.213Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:25.242Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:52:25.267Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:25.267Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:52:25.337Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-4"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:21Z"}],"name":"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269","namespace":"kuadrant-system","resourceVersion":"96984","uid":"201d88fb-88b4-417d-862c-e0df82510360"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:25.341Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:52:25.341Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:52:25.405Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-6"},"creationTimestamp":"2026-11-04T00:41:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:42Z"}],"name":"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec","namespace":"kuadrant-system","resourceVersion":"94674","uid":"c097874a-48ed-425f-982b-8374644feac3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:25.471Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:46:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:20Z"}],"name":"e87c5671fb7d586e5d1ac56b95f2895a3660735e0f6218be2c74be208934dcff","namespace":"kuadrant-system","resourceVersion":"95417","uid":"4b4a2ddc-eb91-43f2-8a41-4b5e787bdb70"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e87c5671fb7d586e5d1ac56b95f2895a3660735e0f6218be2c74be208934dcff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e87c5671fb7d586e5d1ac56b95f2895a3660735e0f6218be2c74be208934dcff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e87c5671fb7d586e5d1ac56b95f2895a3660735e0f6218be2c74be208934dcff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:25.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:48:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:40Z"}],"name":"7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902","namespace":"kuadrant-system","resourceVersion":"97295","uid":"11b5e795-9d74-4fba-8269-8330c6032e32"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:50:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:50:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:25.619Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:21Z"}],"name":"53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e","namespace":"kuadrant-system","resourceVersion":"96989","uid":"f20900c3-e572-4134-863b-e4d2dd366e17"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:50:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:50:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:25.713Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-4"},"creationTimestamp":"2026-11-04T00:42:32Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"}],"name":"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2","namespace":"kuadrant-system","resourceVersion":"95451","uid":"b5ee89ed-fb6d-4ca5-9bf3-286dcba364cb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:49:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:49:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:25.813Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-1"},"creationTimestamp":"2026-11-04T00:42:32Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"}],"name":"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7","namespace":"kuadrant-system","resourceVersion":"95455","uid":"7d2957c2-c3f9-424f-9b1f-7c14f1b25dda"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:25.913Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:46:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:20Z"}],"name":"fdced85e7d18606f04f9395e95e53b677eb683995d773e98eaf2786a2c5c30d7","namespace":"kuadrant-system","resourceVersion":"95405","uid":"123c9170-0ca4-44a9-a35b-1fa0bb787f08"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fdced85e7d18606f04f9395e95e53b677eb683995d773e98eaf2786a2c5c30d7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fdced85e7d18606f04f9395e95e53b677eb683995d773e98eaf2786a2c5c30d7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fdced85e7d18606f04f9395e95e53b677eb683995d773e98eaf2786a2c5c30d7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:25.983Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:46:04Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:19Z"}],"name":"8d53ed113ade160b6e78aabbb905b9967c95c87f900bcd7508e435075d49ef04","namespace":"kuadrant-system","resourceVersion":"95350","uid":"04b30dea-5390-422f-bbf7-4e8f3e1c6960"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d53ed113ade160b6e78aabbb905b9967c95c87f900bcd7508e435075d49ef04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:49:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:49:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d53ed113ade160b6e78aabbb905b9967c95c87f900bcd7508e435075d49ef04"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d53ed113ade160b6e78aabbb905b9967c95c87f900bcd7508e435075d49ef04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.049Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:46:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:18Z"}],"name":"ad94934bef7002e6d043e62454d4634ace243fcb94fe18493e1d5f16b1f3bed9","namespace":"kuadrant-system","resourceVersion":"95343","uid":"784c0db7-f458-4bc5-83d1-3b17774332be"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad94934bef7002e6d043e62454d4634ace243fcb94fe18493e1d5f16b1f3bed9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad94934bef7002e6d043e62454d4634ace243fcb94fe18493e1d5f16b1f3bed9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad94934bef7002e6d043e62454d4634ace243fcb94fe18493e1d5f16b1f3bed9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.117Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:44:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:42Z"}],"name":"140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc","namespace":"kuadrant-system","resourceVersion":"94695","uid":"31955288-a3eb-4f7a-9be9-0bc8807fb638"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.164Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w3-a4fac5","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:41:56Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"0d9286a3-fc07-43a3-ae3f-1766edb49dd0\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:47Z"}],"name":"kuadrant-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w3-a4fac5","uid":"0d9286a3-fc07-43a3-ae3f-1766edb49dd0"}],"resourceVersion":"96147","uid":"b07661a3-d588-443c-b547-70c1165efbf4"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"1430a5f7cebb9d77677f183f65da9337d152a48bfafe3d37cfcd270307c7df9e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"55b91b030f20771875d8f6034586faa2db4fbc70eb10fb8d132882c15d0afaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"a81d3eff92e27ea5f5cac2db6fb0cf1a069bd951f29c48d484e8112db696880b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"d1c07ab63c7120efa7dccc42f9baaadb433c223ccbd44f804d37690d09425337\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"35a8564f19c1b3aa575d12e397fea0f23fdcdb16ef009f7564dc7ef4be46ee1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"cdfcd2d814c040588e2b1d88d65f9904cb2634712e56955e87a10b0a9a284568\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"108afa169d39fac08de3bfac4f917f03a000504129040f5dc69a2cf196d15bef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"618a90afaf2ea3c705eeac6f41eeabe561b7901fd9147e2071041c6dbb9db9d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"d21a8dbe4d63c1c76c5803889f0ed2b730249d1b48deb712d825daaa4657aaa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"140a56f53e92533f58645f23557de4a39ee3b11cab9482e1c84f4bb46f392fbc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"a79d526802843d064aaa2681f2c6d0f890771839ea1eac1556af53e244c7789c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"bfa2ba133701eb0e4e8b1d9e8cff1c70e4152f4531e4bed579458e3897adac39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"dd07a42cbcc7b6ddb89e0ec031168dc4efd39f5fa2d09a3fb842bc0e8b36cee5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"58b33325da28633c2008f7546fee7584b31d404a57cae8a513b38540583b99d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"87e211399dd3bc3d5c1c424239aeb9399f8d04930fa1354a47995f4ae7147493\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"117cdacbdcc2d37da88ad7414ee2519e9ea13a4a30beef73141dcf36a5e4e8a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"a18b0cb0515a2d7f89035cc7abe4cf8dc535d97184538512401ebe29a6152281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"e259fd19a243470b41846cb89513e1f971b70d69b06abaa114e30229c21f4476\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"420f7a9f443a7dc911301904acf52fe84803c60cc435cd53fbfc3c99510d0259\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"0e76def713d30875a17e15c7a8c10c6ffd261a73e93b981aa4748f08f77984ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"c9acea04cbf39f2981dd1a245f18178f137cd6d2d7a643adbca92f59a142c153\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"e1d0e1b4476a1281d74748638e5802057df5161cf75b5267cf760ed1152999d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"340368d8ddc2b2ef6abd4fa7792745eac63d8424a90ecb186cc80096c6eb39ef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"1a7c82c7f9d0780636e05434bdf6e53e13e198a50a23623c5f9f6466c79dcea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"15031e7a1557e38e5db1b74edd83508a08c14602d4fdcd67811e608dfee97daa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"0469aa6ed59e67d28f54962ab8e4029c4dfea8f6a9d9fa9b5071633d22937209\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-a4fac5/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w3-a4fac5"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.194Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:48:44Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:39Z"}],"name":"5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24","namespace":"kuadrant-system","resourceVersion":"97287","uid":"4f079cca-5502-45e6-8ae6-b5b0584348ad"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:50:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:50:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.259Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-2"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:39Z"}],"name":"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299","namespace":"kuadrant-system","resourceVersion":"97291","uid":"1056e779-86f6-4e62-a684-252a104d3b03"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.295Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:24Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4822deea-cfc7-4012-8bab-7aa664065e4f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:51:28Z"}],"name":"kuadrant-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}],"resourceVersion":"98295","uid":"2cb81ab4-d10b-47fd-8ee0-a5914960e25e"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"7172cb955c397212a8a237e97ddbe671d00b0b017de53501a9513b805f985107\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"efccb40cb53abdc75ef2e40cfbdef981590a57aff04818cc90e56ebd130e2c11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"046a2cd0858cfa37810137f11a437a8ab0544003b81ddf8be4949818e3ed026f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"7785967d3a5eea496ef51a2e5cb9772a765b47f865225741338cbbb7fb3389da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"8eeb6c660b878f1ddea428a94e56bdbdbdcba6a75b04f120fae1f900306548fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"16f0f4a6e4245b13c76e2c1bed11331390459226739647281f8d80c0acd7bcad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"679dc523d72fea0e84519fd988b527f7fc7b4b5450642f5a1fbd72a9e066b70e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"d3b69d056b08d543438987d3d0ebb995367297688c77ba7aaac789200b5b3cac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"a8145813a9b56dc34ed50dd81fc379ed19f75a26ecc67269c54fb433b09cd1a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"ac4fceaf94ac5d64795dff012fa45370b94ac89146a0acb81848a9c3ab906e0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"d1f5c82a994de0ca6fc045fedc02e93b2169e18e2d51e2856ee387646a4f47d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"61ebb24ad95a0fa5757c6af03d1afbf26eabefd7b28ddea80aa8719ed1b1cb60\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"4054017d551676f360ee2b85102ef7467a32145a267ee998ac1af417164a378c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a3a89d5efcc396a15a96e4c5fd7b0695ca46c4ed4896f97b747e10565a51902\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"fe45d17f48183d340506e57f357c4e082d211bae83bfacaef49a97c4f8a0c766\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"9b42dee6e04c3405bfdd9c4d5aa535e96611261e9ee53a9453afde2cae291c38\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"394e3d3e513d394af7405819dda49a11aaeac0ae258a0de620d641bfedcac7e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"42a431282d55ae9a02dbe8b838187536c57be626dd90822696cf2176becad44f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"2bf7e63da88c6642991175fd5d4bc2414f8eaf985bbdc7398de47c231db6f66a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"f903e979a9c7e958a8ac8343abef701d933c76001e3754a7d6480dcbe4c9737a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"dbd867a3282f4d3f0b2224e9a0a717b6688c4853b976493add937469edc9dfb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"79016ee4b4f966cf6c441f34579ea049f63637553b8193324bae0aa836b2db7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"df2665493c1179abe9d1eb2a996b4ad965011d3b3e7e7451c8f64999ea7e5e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"c8cc7f1ee42f8704cc0aa6fe662e93eb76b065868d0b1ca19a262a9434302ebe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"37694e0fe4a8a4daee6cd09ea67587f3f90a67fba636fb5f0a92fd82ec0cf000\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bf7dc7c6abe958942dfa098ab23d115d216e9d55f213d867bce8d91b52d7c24\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"4b6b14b9d30c5543b67d2e66eb4a684ff00131454a07461140d489fc4cc6b68b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.328Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:41Z"}],"name":"45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243","namespace":"kuadrant-system","resourceVersion":"94613","uid":"e4dd1531-0c74-4314-8abd-c16626723bc6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"45a76f73bd8765397b4c929ea7c7cb735172d851e1b4aa0e71d8013b7889c243\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.396Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-4"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:44Z"}],"name":"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2","namespace":"kuadrant-system","resourceVersion":"94762","uid":"2c962c20-a86b-4942-82ac-412ef1bc6262"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.462Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:44:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:43Z"}],"name":"c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309","namespace":"kuadrant-system","resourceVersion":"94758","uid":"6bbedca5-07f8-4236-afda-7bf9e983bfb2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c491adec537aa6e434795ac98d9d157bacc702f4e9b4cbe765c156883a597309\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.528Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:46:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:19Z"}],"name":"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0","namespace":"kuadrant-system","resourceVersion":"95363","uid":"fa18f3af-94e1-4f28-a2af-f8681449c295"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.607Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:48:41Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:40Z"}],"name":"97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b","namespace":"kuadrant-system","resourceVersion":"97300","uid":"6aa9479a-ac18-4ce5-b989-607332ba13ab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"97a9fd1daf1e18c5bb52be9ee08a7e72dfac02697ad78370cb06e0e40ac8e97b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.679Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:46:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"}],"name":"b77a5e0afeb2be496e800a4794829b926c52c652770117aa5b0db362b0bdeafe","namespace":"kuadrant-system","resourceVersion":"95443","uid":"602c721d-7b71-48f6-8faf-998386eecfb6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b77a5e0afeb2be496e800a4794829b926c52c652770117aa5b0db362b0bdeafe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b77a5e0afeb2be496e800a4794829b926c52c652770117aa5b0db362b0bdeafe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b77a5e0afeb2be496e800a4794829b926c52c652770117aa5b0db362b0bdeafe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.696Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-ad3cbc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:42:33Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"76771efd-f8cb-4c36-a180-ec37c18f7a04\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:21Z"}],"name":"kuadrant-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-ad3cbc","uid":"76771efd-f8cb-4c36-a180-ec37c18f7a04"}],"resourceVersion":"96978","uid":"100f1380-dea9-4628-a307-626162a0de0f"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"aca16e40627367672911feca4ce7ad8c7d10d0c56a9325a9e9042bdfd312ef5a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"5a35fdf440eb1747f0be7d455fcfcf3c07d25c89609f6b49de909135f9165e97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"7093b3a7d38a93fe38d15834adee61e774120fc2c6a0a3894d3c9255294d1c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"bf2b84457e3fac0dbbcfb3cd9bc82f8514255d2eab07c515b0a29327111fbf99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"7d6dfd905dfa95d9a351dbf895654fe4790d21b1adb8582c116209e79306ecf8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"bbd7f964f8078aaa0f5cc62772775672e33d6cd9dcb67f160a15a881acecffa4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"fbb73665de5400bd2b83e1ecbdc627914e657558a54f2b2c84717502cc63d11a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b335231ba9182f22ce1140a079aadb44638990e9d489d0c58fc2cd79527402c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"4df7175c09f43736bd518303d83e3acf28cdd2af2c5e200955e6430cea58c30b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"9bf97f063f975f92080a902131d0daa53318e53d91b57013cbc27123f26504c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdced85e7d18606f04f9395e95e53b677eb683995d773e98eaf2786a2c5c30d7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"b92fc0814a30fac54f2f9dee4eb549a7a521f2f3def3a796f51530ff0f145629\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b076518fe7919b1938e36a5b319f40543e7a7c4a675fb97f89e65aa020fbc009\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"1b197077f91bb8a7712d10ce1d20b4893f43812be17ba42bb4992071920e1700\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e87c5671fb7d586e5d1ac56b95f2895a3660735e0f6218be2c74be208934dcff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"eb444a73a234648c5da8f9071252a846b917013ba37c22d8650e9759fec31005\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"55b77a36ad6c7f1af559dd1c7e1c61fccbe10745a273f6da1fc83c7b113df344\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"aaf67797e583cde8da01b2d8b952d1256c3c429bee24e8cd88b2b53084d1c712\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad94934bef7002e6d043e62454d4634ace243fcb94fe18493e1d5f16b1f3bed9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"f83f172272f26e977da90def79fdec98548e01eb46b4a6b843fcf8a1d8a7969e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d53ed113ade160b6e78aabbb905b9967c95c87f900bcd7508e435075d49ef04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"cc4340a3b6aeeae490ba48b16f71e56d4ea58805a103990fe03cdb0b9c078df7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4960ec1dabe36ebc181f4cbc408770cf42c568ee0268ff071904ca6708f2dca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"35b51908264f06f5a6c6912231d66bcde3997b9506778f12289e03a97f768112\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b77a5e0afeb2be496e800a4794829b926c52c652770117aa5b0db362b0bdeafe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"4a80118befaf51dc37951b2d2384ce8f333187aa29cf6ee02ed8742b0b9d4e56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ad4c2008f2bcb23bed1eaab3ee0e8664a67c9296abb21de7134a35b26d400a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"41ff8895b121f6ffabe4b0141e2e3235498e697e268a70be670c77edaa7bc0f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a5d239b15e872fe93650a6717424803592cf65b7b48fc64854676a213c6dd6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"4eb6331e513406b95f64a2c41f596a89530baf91b344342d87182b2d763787c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"5dedc6dee45d1abee8c19f6f4c42fb55d06758b5fed0909cf21751bdfe9be5f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"980887992cc7e6c74980cf1fe4e50f09c0f06a300c9323cb555f8f0c45740837\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"92fc99421f6a2bb91b311a13d2db9c621790c803fde132892e7873aa4bc3675c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"967c3cc0acbbd5cbf744b398accf5c5e3d0d0e23659fc20e69ddc0bb3f0a8d96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"92303fb39cb3b4f32df939e72e4c266d891b1f7daac1e5e5697090cfdc30cc3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"26977b28a28ee3b9d2971b6c1c4c2e5d5eee6498d6da7bfb5d930fa3ef701b61\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"3345327cd54009ecfc38f389d5191486bc0d1c6b0c59593a6098c4fd05b46559\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-ad3cbc"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.748Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:46:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:19Z"}],"name":"26977b28a28ee3b9d2971b6c1c4c2e5d5eee6498d6da7bfb5d930fa3ef701b61","namespace":"kuadrant-system","resourceVersion":"95368","uid":"57f314af-14c3-44ba-bf2f-a882665ca37f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["26977b28a28ee3b9d2971b6c1c4c2e5d5eee6498d6da7bfb5d930fa3ef701b61"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["26977b28a28ee3b9d2971b6c1c4c2e5d5eee6498d6da7bfb5d930fa3ef701b61"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"26977b28a28ee3b9d2971b6c1c4c2e5d5eee6498d6da7bfb5d930fa3ef701b61\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.816Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-1"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"}],"name":"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea","namespace":"kuadrant-system","resourceVersion":"97374","uid":"18f49e3b-14bd-4be1-b69a-cce43a8cf8d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.883Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:48:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:39Z"}],"name":"14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610","namespace":"kuadrant-system","resourceVersion":"97279","uid":"7e5cfb4c-0c74-42be-818a-425f8baa1a3e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"14e271f32ae6fb467ec408e50f1b13f510fe5fa9eb9556bfe0b970b2af45d610\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.951Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:46:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"}],"name":"b4960ec1dabe36ebc181f4cbc408770cf42c568ee0268ff071904ca6708f2dca","namespace":"kuadrant-system","resourceVersion":"95437","uid":"579c23fa-015c-493d-87b9-66fdb4e04c8e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b4960ec1dabe36ebc181f4cbc408770cf42c568ee0268ff071904ca6708f2dca"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b4960ec1dabe36ebc181f4cbc408770cf42c568ee0268ff071904ca6708f2dca"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b4960ec1dabe36ebc181f4cbc408770cf42c568ee0268ff071904ca6708f2dca\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:26.985Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-238db1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:42:33Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"a871959e-14fe-46d3-b8f2-00d3bcc71d04\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"kuadrant-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-238db1","uid":"a871959e-14fe-46d3-b8f2-00d3bcc71d04"}],"resourceVersion":"96949","uid":"35f27ffc-a00a-4ce9-943f-67b61b438389"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8870d949acf4562f01e086c66909a00ad03937a04c490e3802fea0847996389a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"72aa89eb48bae0af9de01ff0f33630c980fdbe41a3c20a71c26fd7e9803e64a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8870d949acf4562f01e086c66909a00ad03937a04c490e3802fea0847996389a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"8fb144dd8c525500c6c5b24069bd3f91a12dd65743873dd68affcc4455227bcd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8870d949acf4562f01e086c66909a00ad03937a04c490e3802fea0847996389a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"744b1085204c615e347d451970463f83799e4ad7bf95823f1f1635ec01316d0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8870d949acf4562f01e086c66909a00ad03937a04c490e3802fea0847996389a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"049cf00d1eaa27c20b946adb3dce53d2220e7ecd03559b4e9b0ee32c93486fa4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8870d949acf4562f01e086c66909a00ad03937a04c490e3802fea0847996389a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"4f028d365fcfd71eecefff7e46378c8ae4e69a6617b55aa96e436a623aa4258b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8870d949acf4562f01e086c66909a00ad03937a04c490e3802fea0847996389a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"8a76952f65b71d1253e0a92c4a75a13706ff6e6383a65aba8e668628eb755eed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8870d949acf4562f01e086c66909a00ad03937a04c490e3802fea0847996389a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"ff094d51e54eb0e073295573b4fa20960479f02865662d11e28c7ed967cafc76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8870d949acf4562f01e086c66909a00ad03937a04c490e3802fea0847996389a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"a303cedb94eb88bee4aa2b68c68f656a7a4bb7845501b92c776b4000c0392d30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a00fbe4ede3c0b38fe9870b558dc6cca1ac15f393e533ce225212342e5576\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"7130a2cd01d2c1a8eecf067d885e4657ef312b3d7f30b5e4eac4739658bad541\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"947d8a3fb1f7a087b9cfe4aaeaeabea1baaf7c6c178a9cfb50f90d86af6e8fbe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"d6936cb164c1463f468827aace4877c37eca6abe092bab702c33667ff9e1eb52\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abbf56c56c9a803d3d64020b8a3d0dc37f0fe5e709c20c5417e3c8c4389539fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"1fd60a05dd52faafefddbd9da430f2240c889a2992a5b042a4471df94790b725\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f0cd0db3d12f45cc15b0bc8ac04aad11f9d2cc04acdc6b04607599e7dc40e095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"d544f51727caf1341f9eb4e24fa6cc7fe8243689d5c9200a0677dd7162c61b59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c8f3e92fc9d42a1c187a9eb8632b0f79286f1c82dcffaabb7293b64d9b427bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"241f18efadd582b7c0a10ccad07c2cda12bb45b4bb63a4cc39413347a16bbce6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab5bd91db6811cd09264763b37ba77ed1917c66ec2d774e4690ad11b6c82b3ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"b8c6f23dd0ea226df7d453675569f2607a5666e77d77745c97a1ca59ab431eea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d9ec7182069bee9b143cf8967c3f922c0359d1fc025f1526455683847da9740\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"8499cf0cb46aea1afefddbd72f4d0ed43ce9dd8a9a30ee3a9554361c833ec367\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0edcf08bb6ef09bae6640ba02e005f05704351eab271588f2da65c198ddd139e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"e9297997026d69dc820ea71c43905a9ca0f4ff5e6747643da1e4276db055e55a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2880debdf3647581cb24cde166c573f0f40b777817b404528f0a0a0fc3a9a603\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"df802e926184f43268f3a8373533b20925955b68644edec7d009a5b7eb3e8410\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e448e404dd690c8458be9cd37e5f9d573521fd2a5b9d20449a04a0b35d50c2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"8212ea660e295e602c9a0c82ea7057c62203ac6868702a8c4343f1a50437dda9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05280a26a55f67141555148c6c469e8bb6145daa5fed63aa0d8bf17fee682b07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"992dca4b6eeaadd7fb490def07a7b960b45580fc867055e1e379cf99a032387f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"31f0143a60e13ea6745e7fb61bde4910bfe6acd14bb292dc0539b5f33d751f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"d45b1d00670fab41fe4c23d7fbdb9884306dde94843215fbbfd65a3cdb95fbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b289e3f1befd913bc5c27df0099b83939379105282e4bf360d74f9846054df84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"9039dde6e4107ae3eba9b18e0b483eff317c0a81f9dbd120da663535aa39f3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11c6d0a651652f81b1b93abb5a792126b56c88e30da1b18d815362f7b0ce56cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"8c0d0766432c32f4d1cb9cc2e54ca90e3333e0f672a08ec2e6034557027a73d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"449ca852af47a1b5a00efc7a8325cd4c05b2d460e01b696fcc011d14e0dab138\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"a57315f66093f4812f37dc0bf446d25423c0602dcdcc77576c94ee00e028b707\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63d30fa15f0c2b6c6f5fb22c3e04535e150fe07e2a1261ed59945ab2a4689711\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"91f6dc455b873524b4e6dd78ce85bc6951242eecb740adc87c5d8fc271c787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8946fe388eeec7069e7a3a9819a95adc4fd7fb0fbaf6d983bd2fdaa96837ca7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/auth-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"881af97f0264e0bd227c7292982595b66e989149885907ba5bb544bcbde98fcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-238db1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.024Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182","namespace":"kuadrant-system","resourceVersion":"96917","uid":"f1c8fe65-cb57-4abd-8c16-f519b1e75cb3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.097Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-6"},"creationTimestamp":"2026-11-04T00:44:24Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:40Z"}],"name":"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e","namespace":"kuadrant-system","resourceVersion":"97298","uid":"7d9bb096-d6b9-4d83-81ac-bf237efb3353"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:24Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:24Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.167Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:41Z"}],"name":"c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26","namespace":"kuadrant-system","resourceVersion":"94587","uid":"933030d0-b6ab-4863-a262-b619df65831c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3c20e5c84736277dcbb6a7f94b2107d27294af64a58a6bf57d02531ba485e26\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.209Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-e89576","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:43:52Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"921550b9-e248-45c0-b3dd-b3c75826bf69\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:51:28Z"}],"name":"kuadrant-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-e89576","uid":"921550b9-e248-45c0-b3dd-b3c75826bf69"}],"resourceVersion":"98306","uid":"d0208b1f-740f-4ca5-984a-09841be9a98b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"91f7a7053a21f517ab34a4b3f2950064eb9b7dcdc52c46b83e4d5208e252a2d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"d07b4c2ee86fea861f162f492bed1237c24fd9a5488f03e46f679decbad4180d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"57fa76217ad3dbc03d69aed811e176def2fe3e742903f9e94ee52f47d87408ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"f3b738e68b88a1e573178c458a218504e7723aa1d76e387a40dbd12f3f428f25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"728d9d2370648df2628f68f6f78af93338635166b5556ba8a40cd73684f218c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"d2f6a2c21f2cb295e96ce8fe47552b698566ab11eb6689c59e9a41c981f09705\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"e3f8064b2232a40f7ab6b13ce5ae8f654434585ba6c2c3017e2ec826931a2039\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"1b27255fa74c331158cbc80c48f67c27c6cc5f1d1668b25f81d80344d9d8377f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"3ea848ea7a28ccec66fa770b3af2452b6b0b907146017230150b4eb245cdf478\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f21e248dc1b31953c5787573899fb96d9266de57e323858ae157c43a8532182\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"d87db5c44ec951543284c283780ad49608d5b656d9ca3c8fbdd1cd6aeae044d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"89f25bfa769a1ccae56a7308dd2222e2acf515931782f00da579a0232909f440\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"7af194dd2b2a0c46e1777d202fbb37304bde667be67ddedab9499a35c047e5c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"53334282f9f48c765d07daeb783edd21956934dabcc898498105918cfbbd3a6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"d905c78da0cdf5f478de32358c2ae4dca582c958378c3883302cfcacc6b9da7b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"37c1860e1e4e68930b60168d1b0d31a91986f7d6c3d255500ae73e690c83f305\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"3d0875e7d40a1006f6dc884ebf4c6e76c73bd4743b08b8c254a3978e60371ebd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"c9b6409d871df38dfc216c339dcdbdddc6957e188e5670fe8a2f2d9c0b4f20a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"f83aa8482d6e610c9510479b619d42f446d9007036f44659c74719a84e346dc3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"7e7b72bfb2fa2ea6ebd96ad65672c2491a36cd2c9af379efb21163d9027cc733\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"2104afad6813867295f0ed2aa30579d6f295321af446b9ff84541d5760eff2e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cbb2bfaa3f7807da810e5291128dafdf0ad6a95e35e1e8579ba5c146fe1b92b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"755a0cc7a588e772af9132fcda445bc892a59b574f2f7284b043f1d478444943\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cfbf9c267cd9cb7b63a74fd1748936a93876c7424601b821496ba7463c22e3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5b4bf640448cf71b6adb08f5416cb2f93badffbd5e65a485b88a5db0cb08b40c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"493cb8642d7cbb23499392f14e4d28be76ed3e633c56318221b47ff22efa9714\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"009cd1f683b207a3c2fdf7b320e247395f6d0b0c92eb99f299f7f9d322ed3374\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-e89576"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.238Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:21Z"}],"name":"aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016","namespace":"kuadrant-system","resourceVersion":"96980","uid":"9a0f5041-91a8-4922-bb73-32f9bbcb915d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7f9d5430aba644ad078b1023f72bd3ccaa9aa353d3de6d4b9dc460dbc83016\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.304Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:48:42Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"}],"name":"11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4","namespace":"kuadrant-system","resourceVersion":"97383","uid":"b905020e-bd85-4550-aa07-76d4237ab759"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"11703d25be78e15ac2609b2691a76dfc1988f5939c37fa680c07fb90790c29c4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.347Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-516871","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:58Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59262430-a65d-4fb9-8082-a5ebbf86b6f6\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:51:28Z"}],"name":"kuadrant-e2e-shared-b-w2-516871","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-516871","uid":"59262430-a65d-4fb9-8082-a5ebbf86b6f6"}],"resourceVersion":"98331","uid":"f7839c9e-8ba0-49f2-b1b3-fba72e0e34b1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"9f95746066d990c42937a8fde6359a2552e50daa27967be248fada4716bcdd86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"0646aac9ad09f46890b8f2bfcb899fa6b99244f16df481bd753d864a2afc5f90\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"dcac5b8041d1f0f6bc5037e8aa068e769232a883e756caab4d5b53bbd64b3852\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"d09b5f6bf44ada63939ebe5cc099b77efb8bec389c189ed49528e880f25388e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"277cec8d8e3602511bc056209377366037fc08e78c3a91f63bc7f829db29b1b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"49b4ea6d228c91fe1b8b2b38f6b2a6623061d5164c2031a57119dc2fa3661283\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"9cb7c12e66536a4daab20fe81bf757770a5745f6f78794b59b6e336d62beeb03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a7c2d07d06ced8c8c72dd8ad1857dab9588907759498d0337f3489baad5f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"1fe25fb253f097d5189a8ca583d1e1fb920cd2428458393cf4a5cc6a8cc93393\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"b0bdf1559fb724e46b834693961ac80012ba18b84f1f7e761830354d69b6c20f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7c935768e90db20277ece574a7f8dfd6f0c2b7b8e8cca8e566c776c658a0a1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"845121c70923519dba3cfdad1eba2b3af3e4ff0821e689fd5514dbb648d006d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"761bf797bcc200d116ffeb19a7e6853e812ba417d574cf6f957bdd3ea40d9e3d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6f4cf8bb0a13d953b6933a79a08e64b47ac3583869c5e380c20819ca412b7d4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c61e0c8efed24f831d57a2f9d9eb6015ab04e5299d81a2404abddc94efeb7b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"5a19d657435e3f74156bf71a1ef2940a801e11dd88beff9bb2cb1b59efacd85d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ee206b9d197095d798d970d5a59ea79142db3a941b81c4d6df21ed9f2179023\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"f584a124894bd1090b63b2743f32e87bfcfb632fe878570452e0e9531e17b6a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6420733e1d82ed35c0ae5322fe3c75e21a926c6b2b3c7aa2c3fc8609e6bf2b46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"091b2f1c1b22b01bb79345cbc6846c65e0d3a928aef47124e4b3d8ef8c275bf2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b922bdeb28ead1b13774ce102977c443fbdd7d138fff61a9345adb7435f0589c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"3d34199565ac71e609747ffb92469792feebcd3fdf905d67f9960df6eae7e52f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"02561b9b5f195122bef8a9bc77eb12bb907cafd2c32dffa369106309197b0615\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"db3546065575f4a543d3abcfc21c38102ae3242dd76d412103465dada7219e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461900dec749bf597c6108ea637f2c131e4d31226ff12ae3650b3d2628ee91a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"b386b309d2b93f103a3ab3e23cc7d5998bb8393794a30e8b2a7583ee1e876222\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cd8b7232e1f7de3fdf226b7dc817264d0cb9b607a92bbf3d050abc3a903053\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"9489c7d910e0dbf4d066ca58f896cc05e1b16910faa4308dcc6fe6097513168d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a5b336bf2774a6b44cb0093737fb0b86d5e26bb8c672aae4f9ae8f3456a5fea9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"d0383afbccf920cdc1f58f2141576b2a7578f2443cb2188b93412c17c8818f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6118ee007d06753619cdd3723e5f364a3646a3c9d99cd0e248a2b041cedc688e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"ae0c5d6228fd93a9b5aa81cf9c846a9343adbd4f82f7085a13f27f7d910fe0c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"93f6801119535020e051e319ff1814709e08eba59d41d11da398d6675db1d33b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"c43b20454038dbfa463db22fa3ec806267111d0d7471710a880d546f9c04b08c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6a5ce3b5e4931a7f21c9b99482f16a36f46eb3341d6754ac80a7a492496aaca3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"949c3ba0fa4e5ad6bb7ab3a9250d0df7228141042f873672e005fd77b67dcb3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/auth-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"1a3aff9adf669cba66da7064a688240cd5795225e6d8837cbaca9dcf158740a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-516871"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.371Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:21Z"}],"name":"f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6","namespace":"kuadrant-system","resourceVersion":"96960","uid":"264c4147-4b59-4a9e-ad99-cef400c1dc4e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f83ab0f1f591b5aadc11ad9d1588369e9b0d1a1c3598a2d257a408d478c852a6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.438Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:44Z"}],"name":"fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594","namespace":"kuadrant-system","resourceVersion":"94767","uid":"bcbee6a9-73f4-4403-92d0-6057968d36a8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fa2b19ddb575c7b06204f874da892df5b8d03b8527dd92fe1e0170343b9bb594\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.504Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-6"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a","namespace":"kuadrant-system","resourceVersion":"96932","uid":"469b6757-a23e-4587-b27b-dbc4a05a8f65"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.572Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-3"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:42Z"}],"name":"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908","namespace":"kuadrant-system","resourceVersion":"94629","uid":"3b79844d-57b8-440a-a3bd-feecbc0c50c2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.637Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-5"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"}],"name":"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464","namespace":"kuadrant-system","resourceVersion":"97378","uid":"4b2ce0a5-a4a8-44bc-934b-813461b496fb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.703Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:48:41Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"}],"name":"4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac","namespace":"kuadrant-system","resourceVersion":"97386","uid":"b25a05d2-2bc0-4419-ab78-db8301b152be"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4bcd185b2cce09d5eeff54d7bba5c7e2accf63457bdf25a4ebce198639ca30ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.769Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-3"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:21Z"}],"name":"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031","namespace":"kuadrant-system","resourceVersion":"96974","uid":"ffe39315-1b74-4d89-96a6-3e9ceddb9fa7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.836Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-3"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"}],"name":"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334","namespace":"kuadrant-system","resourceVersion":"97399","uid":"b34fad4e-4aa3-4133-88c8-f305c7b0ccce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.901Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d","namespace":"kuadrant-system","resourceVersion":"96948","uid":"8aaafee6-55fd-4d69-aa4b-fff558da1e7d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5114cb44d61750c20793b44a0c74391ea3cc5950a722b58d98a92956c088d23d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:27.968Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-2"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba","namespace":"kuadrant-system","resourceVersion":"96941","uid":"13c19c32-a05b-45ad-b342-51985f50b059"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.036Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:47:11Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976","namespace":"kuadrant-system","resourceVersion":"96943","uid":"ea8ad41d-72b1-4ed1-bfe0-47ef3371e06d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1174563aef20fc98cc458c591573358d82a408218a59336ee5d0ecac902ed976\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.101Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:46:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"}],"name":"64a5d239b15e872fe93650a6717424803592cf65b7b48fc64854676a213c6dd6","namespace":"kuadrant-system","resourceVersion":"95431","uid":"b9e1d954-cc2c-4d20-9b1e-299bbfabb28b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["64a5d239b15e872fe93650a6717424803592cf65b7b48fc64854676a213c6dd6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["64a5d239b15e872fe93650a6717424803592cf65b7b48fc64854676a213c6dd6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"64a5d239b15e872fe93650a6717424803592cf65b7b48fc64854676a213c6dd6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.166Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-5"},"creationTimestamp":"2026-11-04T00:42:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"}],"name":"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a","namespace":"kuadrant-system","resourceVersion":"95440","uid":"9038beae-ade1-4bcf-80fe-8adee6066f06"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.232Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:45Z"}],"name":"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801","namespace":"kuadrant-system","resourceVersion":"94823","uid":"47f65a7b-03fb-41d9-8d6d-fda4567b5b69"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f250cec0032cdbe70fbaf5c9d4a7f7de9e698fd64b3cb2302ea36f7cd7fb7801\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.300Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:48:41Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:42Z"}],"name":"5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570","namespace":"kuadrant-system","resourceVersion":"97414","uid":"dcece4b2-00ab-4d58-8e66-dcf6a235cca0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c4e1664de006f4aa0c1494f8f1d48a5b9c7dec3fc91ed37fe77e7010a147570\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.368Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980","namespace":"kuadrant-system","resourceVersion":"96953","uid":"02a9096a-d8dd-40d4-8597-ab8f1df7dcec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:47:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:47:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"49017fde45ef8c7588ee9488f5ab826d8928aa38809943ae8c3f158c47a30980\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.433Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-3"},"creationTimestamp":"2026-11-04T00:42:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:20Z"}],"name":"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387","namespace":"kuadrant-system","resourceVersion":"95411","uid":"fb5c1b53-a25a-4ffc-8db8-8da0c4643c02"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.500Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:46:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:19Z"}],"name":"2ad4c2008f2bcb23bed1eaab3ee0e8664a67c9296abb21de7134a35b26d400a4","namespace":"kuadrant-system","resourceVersion":"95366","uid":"d0e0762f-22e6-41d3-b33c-b57db5196e6e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ad4c2008f2bcb23bed1eaab3ee0e8664a67c9296abb21de7134a35b26d400a4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ad4c2008f2bcb23bed1eaab3ee0e8664a67c9296abb21de7134a35b26d400a4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ad4c2008f2bcb23bed1eaab3ee0e8664a67c9296abb21de7134a35b26d400a4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.566Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284","namespace":"kuadrant-system","resourceVersion":"96939","uid":"317faaa8-4cd3-4d07-a839-62c4dee70f5a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:47:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:47:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"95b8c213b8af887308e34c733469a275edf248c0eb59944beecfe6301fb91284\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.634Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-1"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:42Z"}],"name":"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb","namespace":"kuadrant-system","resourceVersion":"94664","uid":"074658b5-7e74-475c-90a1-7c854767056e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.700Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:46:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"}],"name":"b076518fe7919b1938e36a5b319f40543e7a7c4a675fb97f89e65aa020fbc009","namespace":"kuadrant-system","resourceVersion":"95435","uid":"d0c7a026-e73c-4348-bbc4-5e3402bd93ff"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b076518fe7919b1938e36a5b319f40543e7a7c4a675fb97f89e65aa020fbc009"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b076518fe7919b1938e36a5b319f40543e7a7c4a675fb97f89e65aa020fbc009"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b076518fe7919b1938e36a5b319f40543e7a7c4a675fb97f89e65aa020fbc009\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.765Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e","namespace":"kuadrant-system","resourceVersion":"96936","uid":"d6a83f44-5869-4bb8-835e-fbe908c1c53b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:50:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:50:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e6f5c950446beb827e50e07a0dbb7ea4ecedabb596dda368f2c95cba2d7c571e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.830Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-2"},"creationTimestamp":"2026-11-04T00:42:32Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:20Z"}],"name":"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980","namespace":"kuadrant-system","resourceVersion":"95397","uid":"0cb723de-253f-4012-a6d3-88c86c8e4f2c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.897Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:44:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:44Z"}],"name":"8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43","namespace":"kuadrant-system","resourceVersion":"94791","uid":"c33b66db-b418-4cd5-a4ba-5a5c397342da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8f0e29798830c7d16677cc73b873e09f3c74a9ceb5f7e30387ee58cdcc8bde43\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:28.962Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:48:41Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:42Z"}],"name":"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3","namespace":"kuadrant-system","resourceVersion":"97408","uid":"30431a37-aa6f-4580-b010-1814b41f83c5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fce38cbd534925d529eb496d58a58163ae09bbc1b66900d89ced7eb6bbe195d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.027Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:48:42Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"}],"name":"52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c","namespace":"kuadrant-system","resourceVersion":"97389","uid":"438b4551-fc48-4beb-a2ff-e77690560624"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"52a58bd00a7724c5091508eacf8e4b3e5291600505f439786be7ed189c49934c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.093Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:48:44Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"}],"name":"c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f","namespace":"kuadrant-system","resourceVersion":"97369","uid":"c77d95a0-ad9c-4686-8f2b-a8087b54d179"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c19103e7deffc2078c6e25bffcb2cdc0c9c4b4ac9ebfb44a0fd531656b91d20f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.159Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-1"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:21Z"}],"name":"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725","namespace":"kuadrant-system","resourceVersion":"96967","uid":"e8d8581b-f114-4841-ba9b-ee605bcf708e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1","namespace":"kuadrant-system","resourceVersion":"96928","uid":"c295beb7-54e6-471b-b679-7acabb830c96"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:50:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:50:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ec1dbfeebe6e26133b09108272af1ca9bff68f332fefc22086e82cca1e82bfc1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.292Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:48:44Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:40Z"}],"name":"510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee","namespace":"kuadrant-system","resourceVersion":"97333","uid":"5841a417-96ac-4d00-b3b1-3671c42d67f0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"510ad8630460486e9af13e25c9e45b6dd7a91438db787eec6731902f65c041ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.359Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-4"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:40Z"}],"name":"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2","namespace":"kuadrant-system","resourceVersion":"97351","uid":"741267a2-419c-408c-9ffc-5c69246c79cb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:50:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:50:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.425Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-6"},"creationTimestamp":"2026-11-04T00:42:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:20Z"}],"name":"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a","namespace":"kuadrant-system","resourceVersion":"95389","uid":"2642d7a5-af27-4b58-823d-2ae27a975cef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.491Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-2"},"creationTimestamp":"2026-11-04T00:41:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:44Z"}],"name":"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d","namespace":"kuadrant-system","resourceVersion":"94781","uid":"ad017b8b-d2d9-4883-b9ff-12273ea4ce74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.556Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-5"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:21Z"}],"name":"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4","namespace":"kuadrant-system","resourceVersion":"96997","uid":"c58946c0-cfce-4bba-b385-8a41c2b389ef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:50:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:50:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.622Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:44Z"}],"name":"435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7","namespace":"kuadrant-system","resourceVersion":"94775","uid":"e6d65583-a5e0-4f31-b091-cbc70ba0887e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"435c9c81f0cd5020dd37e5e24c3a65eb2918225112b98342d4e1bea6da51e8d7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.687Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"}],"name":"af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304","namespace":"kuadrant-system","resourceVersion":"96914","uid":"eff09b78-6d97-443b-a99c-b67826966213"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"af46c02ece99cb1304fc2e27a040f69f6fd5452aeaabcc1be0cac498dbfef304\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.759Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/auth-test-model-d48ff4-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:48:44Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:41Z"}],"name":"70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344","namespace":"kuadrant-system","resourceVersion":"97357","uid":"859308ac-4845-49d0-84ec-7dbecca02775"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:50:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:50:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"70bf15d98e029c6a8981fd211d0e2cbcf209d4dca2669d1dd04b8e83a6279344\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.848Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/auth-test-model-e89576-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:47:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:50:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:20Z"}],"name":"fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272","namespace":"kuadrant-system","resourceVersion":"96951","uid":"b8d7cdd6-adad-49d2-97ab-a7aa6c77e03c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:47:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fc8ad61064fb91b6d5afb6b9a53dde75645270329dbf60253af5f12905355272\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:29.934Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:42Z"}],"name":"781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e","namespace":"kuadrant-system","resourceVersion":"94681","uid":"a47d1f8d-2424-4264-b99d-b05a71a80657"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"781e476ec5a606f6b82034feddf7a90fd169a7d213591c39bb9037a5a913604e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.005Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:44:59Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:43Z"}],"name":"adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba","namespace":"kuadrant-system","resourceVersion":"94752","uid":"481ca9e5-e244-4879-aade-fe3406d4583b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"adbf2641557856d60a8fc331c7dc972cb093d2e18b0d2c4532070ab5bf5da4ba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.071Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:43Z"}],"name":"f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9","namespace":"kuadrant-system","resourceVersion":"94712","uid":"2278ca7a-9821-4124-a9d2-9cdde904ce24"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f23f4750eebfaaab3797e8f59d1e2d285fcda20fe66751cbac9ce07a36ba76b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.137Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/auth-test-model-ad3cbc-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:46:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:49:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:20Z"}],"name":"55b77a36ad6c7f1af559dd1c7e1c61fccbe10745a273f6da1fc83c7b113df344","namespace":"kuadrant-system","resourceVersion":"95423","uid":"eee3d95e-cd02-4551-874f-5a43f0d58a62"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["55b77a36ad6c7f1af559dd1c7e1c61fccbe10745a273f6da1fc83c7b113df344"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:46:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["55b77a36ad6c7f1af559dd1c7e1c61fccbe10745a273f6da1fc83c7b113df344"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"55b77a36ad6c7f1af559dd1c7e1c61fccbe10745a273f6da1fc83c7b113df344\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.203Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-5"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:42Z"}],"name":"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac","namespace":"kuadrant-system","resourceVersion":"94669","uid":"8559c22c-05ea-48dd-8249-146f081a99e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.270Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/auth-test-model-a4fac5-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:48:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:48:43Z"}],"name":"01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156","namespace":"kuadrant-system","resourceVersion":"94745","uid":"0d04a869-6a6f-4d2a-afd6-8f0101895bfe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"01c03c544a1a0414fd74ce9f465e6a16cfc4ebc33f846609f9b5616ecfb8a156\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.415Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-explicit-ec8706-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-explicit-ec8706-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.453Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.483Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-d48ff4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-d48ff4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.514Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-explicit-ec8706","namespace":"openshift-ingress","uid":"ad0c50c8-29c2-4440-b9c3-ade50ba1eb1b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-explicit-ec8706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.853Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-238db1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-238db1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:30.999Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-516871-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-516871-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:31.067Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-a4fac5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-a4fac5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:31.136Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-ad3cbc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-ad3cbc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:31.282Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-e89576-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-e89576-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:31.545Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:31.607Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:31.666Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:31.727Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:31.974Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:32.092Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-a4fac5-kserve-route","namespace":"ai-tenant-e2e-shared-a-w3-a4fac5","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-a4fac5-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T00:52:32.109Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-a4fac5","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:32.170Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:32.301Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-516871-kserve-route","namespace":"ai-tenant-e2e-shared-b-w2-516871","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-516871-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:32.435Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-e89576-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-e89576","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-e89576-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T00:52:32.501Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-ad3cbc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:32.562Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w1-e6c59a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:32.563Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-238db1-kserve-route","namespace":"ai-tenant-e2e-shared-a-w2-238db1","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-238db1-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T00:52:32.725Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-238db1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:32.783Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-ad3cbc-kserve-route","namespace":"ai-tenant-e2e-shared-a-w4-ad3cbc","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-ad3cbc-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T00:52:32.918Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:52:32.925Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-d48ff4-kserve-route","namespace":"ai-tenant-e2e-shared-b-w4-d48ff4","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-d48ff4-kserve-route\" not found"}
{"level":"info","ts":"2026-11-04T00:52:41.320Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","EnvoyFilter","HTTPRoute","AuthPolicy","TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"create":3,"delete":5,"update":101}}
{"level":"info","ts":"2026-11-04T00:52:41.723Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:44.740Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:52:44.852Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:52:44.852Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:52:48.653Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:52:48.656Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:48.718Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:52:48.722Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:52:48.726Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:48.726Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:52:48.819Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:52:48.819Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:52:57.128Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:52:57.128Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:52:57.902Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w2-516871","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:53:05.688Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","EnvoyFilter","AuthConfig","Gateway","ConfigMap","HTTPRoute","Limitador"],"eventTypes":{"create":13,"delete":61,"update":41}}
{"level":"info","ts":"2026-11-04T00:53:06.108Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:08.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:53:08.857Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:53:08.857Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:12.041Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:53:12.053Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:12.053Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:12.056Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:12.056Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:53:12.063Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:53:12.233Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:15.385Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:15.385Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:23.825Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthPolicy","Limitador","ConfigMap","AuthConfig"],"eventTypes":{"delete":12,"update":6}}
{"level":"info","ts":"2026-11-04T00:53:24.155Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:25.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:53:25.841Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:53:25.841Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:29.822Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:53:29.829Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:29.835Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:53:29.835Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:29.848Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:29.848Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:29.856Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:53:32.977Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:32.977Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:53:33.855Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-ec8706","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-ec8706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:53:41.439Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","ConfigMap","TokenRateLimitPolicy","Gateway","Limitador"],"eventTypes":{"create":1,"update":24}}
{"level":"info","ts":"2026-11-04T00:53:41.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:44.151Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:53:44.355Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:53:44.355Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:44Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-77b30e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-77b30e","reconcileID":"af30b519-f411-4e8e-8060-c2297ae0d024","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-77b30e","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:53:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-77b30e","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:53:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:53:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:53:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:53:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:53:46Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-77b30e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-77b30e","reconcileID":"8cd591e5-c1b9-492b-bd41-67a43873bd1a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-77b30e","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:53:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-77b30e","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:53:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:53:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:53:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:53:47Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:53:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:53:48.051Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:53:48.057Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:48.113Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:53:48.116Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:53:48.124Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:48.124Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:48.232Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:53:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","reconcileID":"33fbe267-93fb-4306-adea-3d5bc5e1729f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:53:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:53:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","reconcileID":"119c1cb6-dcf8-4c41-81dc-e957c80c5955","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","reconcileID":"e9a93a37-0b15-471e-8de9-5121b8727675","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:53:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:53:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:53:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:53:51Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:53:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:53:51.387Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:53:51.387Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:53:52.283Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-fb2a9a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-fb2a9a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:53:52.480Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w1-7cdb6d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w1-7cdb6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:53:52.540Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-77b30e","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-77b30e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:54:00.069Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","AuthPolicy","TokenRateLimitPolicy","EnvoyFilter","Limitador","ConfigMap","Gateway","Kuadrant"],"eventTypes":{"create":19,"update":30}}
{"level":"info","ts":"2026-11-04T00:54:00.428Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:00.449Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:03.953Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:54:03.959Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:54:04.142Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:54:04.142Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:54:04.231Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:54:07Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","reconcileID":"f8a35c31-5eb8-4628-a6a3-8be014d300ea","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:54:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:54:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:54:08.424Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:54:08.426Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:08.433Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:54:08.437Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:54:08.449Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:08.449Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:54:08.537Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:54:08.537Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:54:08Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:54:08Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:54:08Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T00:54:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:54:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","reconcileID":"f368fc4d-e0d0-4bd3-8a44-b87393a8f8db","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:54:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:54:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","reconcileID":"d64fbb35-88d9-4b35-b67b-9413b590e7a7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:54:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:54:12.375Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:12.375Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:54:13.723Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-3fb57a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-3fb57a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:54:22.067Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","TokenRateLimitPolicy","AuthConfig","HTTPRoute","EnvoyFilter","Gateway","Kuadrant","Limitador"],"eventTypes":{"create":33,"update":16}}
{"level":"info","ts":"2026-11-04T00:54:22.440Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:22.457Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:28.714Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:54:28.736Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:54:28.861Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:54:29.026Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:54:29.026Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:54:32.930Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:32.938Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:54:32.930Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:54:32.947Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:54:32.949Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:32.949Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:54:33.055Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:54:35.872Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-e6c59a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w1-e6c59a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:54:36.524Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:36.524Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:54:37.335Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-ec8706","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-ec8706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:54:46.039Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","HTTPRoute","AuthConfig","ConfigMap","AuthPolicy","Gateway","Limitador"],"eventTypes":{"create":9,"delete":1,"update":13}}
{"level":"info","ts":"2026-11-04T00:54:46.392Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:50.134Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:54:50.418Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:54:50.418Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:54:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-ec8706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-ec8706","reconcileID":"594e2f48-f98a-49d3-87ec-903d53cc2831","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-explicit-ec8706","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:54:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-ec8706","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:54:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:54:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:54:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:54:51Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:54:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-ec8706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-ec8706","reconcileID":"594e2f48-f98a-49d3-87ec-903d53cc2831","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-explicit-ec8706","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:54:51Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-ec8706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-ec8706","reconcileID":"c30b341b-750c-4aaa-a052-78135c3b8a30","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-explicit-ec8706\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:54:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-ec8706","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:54:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:54:51Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-explicit-ec8706\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:54:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:54:54.731Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:54:54.731Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:54.739Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:54:54.741Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:54:54.753Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:54.753Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:54:54.968Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:54:54.968Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:54:58.836Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-explicit-ec8706","namespace":"openshift-ingress","uid":"ad0c50c8-29c2-4440-b9c3-ade50ba1eb1b","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-explicit-ec8706\" not found"}
{"level":"info","ts":"2026-11-04T00:54:58.958Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:54:58.958Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:54:59.475Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-ec8706","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-ec8706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:55:11.663Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","ConfigMap","TokenRateLimitPolicy","Limitador","Kuadrant","EnvoyFilter","Gateway","HTTPRoute"],"eventTypes":{"delete":19,"update":24}}
{"level":"info","ts":"2026-11-04T00:55:11.989Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:12.013Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:15.126Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:55:15.459Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:55:16.039Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:55:16.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:55:16.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:55:20.416Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:55:20.431Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:20.436Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:55:20.441Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:20.441Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:55:20.443Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:55:20.727Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:55:23.989Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:23.989Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:55:25.327Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-fc376d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-fc376d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:55:25.856Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"create":2}}
{"level":"info","ts":"2026-11-04T00:55:32.652Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:55:32.652Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:32.663Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:55:32.714Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:55:32.721Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:32.721Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:55:32.776Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:55:32.776Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:55:32.790Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ab5bb0cfb81154b798eaf490b2f896a5995086707b07f4748895928cac7f1ece","error":"authconfigs.authorino.kuadrant.io \"ab5bb0cfb81154b798eaf490b2f896a5995086707b07f4748895928cac7f1ece\" not found"}
{"level":"error","ts":"2026-11-04T00:55:32.847Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f6e048e2ecee6ac10c99fdc9a31534fdc402a79e067941b75e9750b865de652d","error":"authconfigs.authorino.kuadrant.io \"f6e048e2ecee6ac10c99fdc9a31534fdc402a79e067941b75e9750b865de652d\" not found"}
{"level":"error","ts":"2026-11-04T00:55:32.932Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/612a9aabc0c5b31455e44266231373cfb3f5a1438e7bc56095e1945323f58e33","error":"authconfigs.authorino.kuadrant.io \"612a9aabc0c5b31455e44266231373cfb3f5a1438e7bc56095e1945323f58e33\" not found"}
{"level":"error","ts":"2026-11-04T00:55:33.013Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fc8f8f8a560747bb19af795914cb6f2435df5d76e0bf0fd7fe76ffa5c9c7ad95","error":"authconfigs.authorino.kuadrant.io \"fc8f8f8a560747bb19af795914cb6f2435df5d76e0bf0fd7fe76ffa5c9c7ad95\" not found"}
{"level":"error","ts":"2026-11-04T00:55:33.068Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a9e5e5c3e33e6b069e3fd19f80678aff8bd9d116961ee191667852b526ab2db9","error":"authconfigs.authorino.kuadrant.io \"a9e5e5c3e33e6b069e3fd19f80678aff8bd9d116961ee191667852b526ab2db9\" not found"}
{"level":"error","ts":"2026-11-04T00:55:33.122Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/407c5ea84515eda2bf78294f9bed97e20983083f4acffb449341e9b757ff7aef","error":"authconfigs.authorino.kuadrant.io \"407c5ea84515eda2bf78294f9bed97e20983083f4acffb449341e9b757ff7aef\" not found"}
{"level":"error","ts":"2026-11-04T00:55:35.446Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-e6c59a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w1-e6c59a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:55:36.141Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:36.141Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:55:36.333Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-fc376d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-fc376d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:55:45.264Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","Limitador","AuthPolicy","TokenRateLimitPolicy","AuthConfig"],"eventTypes":{"create":3,"delete":6,"update":4}}
{"level":"info","ts":"2026-11-04T00:55:45.614Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:48.642Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:55:48.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:55:48.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:55:52.648Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:55:52.649Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:52.660Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:55:52.714Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:55:52.723Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:52.723Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:55:52.840Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:55:52.840Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:55:56.612Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:55:56.613Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:55:58.643Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T00:56:05.232Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:56:05.246Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:05.246Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:56:05.247Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:05.247Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:05.253Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T00:56:05.365Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:56:05.365Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:56:06.361Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-e6c59a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:48:42Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5ade722c-b227-4494-8769-73c06bb9dc7e\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:52:50Z"}],"name":"kuadrant-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w1-e6c59a","uid":"5ade722c-b227-4494-8769-73c06bb9dc7e"}],"resourceVersion":"100908","uid":"45fb25e8-fa6f-4f9d-be30-a043bd501a05"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1169c4fa42ebbcd1d2a52d77026bcaa331c37032c1d0d4f197a651ae61bb6980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"beaaa9812eff142da6af13b45893860f9eb4161caafaa7cc2c39094a8066c129\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1169c4fa42ebbcd1d2a52d77026bcaa331c37032c1d0d4f197a651ae61bb6980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"2852338a508d65d36af34cb0950519aeb6e4675bed21f02605616a9479ad29f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1169c4fa42ebbcd1d2a52d77026bcaa331c37032c1d0d4f197a651ae61bb6980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"151bfa8f7be46d49fd63db37cb5de6bc016d1b4fe40bccf9a12a8fbb5d7cfb4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1169c4fa42ebbcd1d2a52d77026bcaa331c37032c1d0d4f197a651ae61bb6980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"2c413591779c13e770837b1a55f248eda00aafb8b53b1f43eb5903fb116ec15f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1169c4fa42ebbcd1d2a52d77026bcaa331c37032c1d0d4f197a651ae61bb6980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"b1606009d0cfdff5114e1973f3302469b3ded2eaddfb477827f408d01d3a0cd4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1169c4fa42ebbcd1d2a52d77026bcaa331c37032c1d0d4f197a651ae61bb6980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"69367bd98e7c0a2f761fa147a7b59a5997e5666a23c64144d569c79814dfcf17\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1169c4fa42ebbcd1d2a52d77026bcaa331c37032c1d0d4f197a651ae61bb6980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"cdbe0280191612a5e3d28ad4a59acea697c1446e2c28e345db3185112f9c6b80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1169c4fa42ebbcd1d2a52d77026bcaa331c37032c1d0d4f197a651ae61bb6980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"635e07edf0912243e8491ef5ec98d59aa3123e6d887dd05c89eafd9c03f7efb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"314672513711dee5adf50319e2d21cf21916637b1af195669f8677efcd77cfdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"d93e0d81582ca025fa16280a90ed0053ccf4d3bfd0ad56d0c775a2a8f02804e7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f783f146ee1b5d91152c92684e00df259b615863ca06b77a8a67251c4259a378\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"a14b30fced2d5492d8e6b2821c67d8c5d6ec4c859fffa777d891eda17b6d6b29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"617109af3069356bc10aef2577171c69eef4ae32f46aa419d04ca778ff776160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"348b0f64793ce2f034190b0e86008affd31448d40aa16ed3f6a77f77af538171\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71f78d1164fb10863eb0a84934d4565ffa5384c10bd978a68046fb8fa9028e71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"27230039a0a9cea8e76ab3c2b22ff163f0c5b24421fd386b4c64d2076918f81e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"983ce6d5979dd8cafcbfe785db279ec27d0b26003ee15a2c6d8a1f9c6d3621a3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"aa10d118af35d4ec952f87d23eae3ee51d8666ca189fb73cd5da68ce8139664f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cbcc3a687359dacb3897ff9d17aceecca00ee8921fa3efd4223979ce67a83bc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"2c65cc72f93020b1c54ff25d5386be9d1971597be4e95730a19a2ff7b0a0cfbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b6f015c145086dfc1f6390f5ddd93d71f7745fa0adfc933266227c2031b32cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"27efe13a767880523e0c166fffc5e3f0c689ed580001332cdb75786774625017\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eb7edbca07f66ee86fcd3cc71e27cb45811855527c5705e638bff683844281c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"b9ad2e8dad8fdba6039d3da05cfbb36ab7700d0fb9b7a62af4cc20fdbb38738b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1497d7090824cb4284ac2735f98057f40d22bcb96151c0cd41043c3ae5b1bef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"4248c034df56f68e4fce52cfabbbb44c24e7c85a8b8d984cb04f4e867421b463\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e38b140898b5e4cfce5c7685de5768d7850ac6a0fa625927fe45defb3de15e00\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"5ed65b5b5817fefb35fe60ab1bdeb94bbad7cd315cad3106fae121c57d60c552\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"169b568126ec7328fc4b11af8bdb4a21ce844e022153bf2884b4d63cbbef6b3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"0407597edba0863ddab2f573459d079dc09b5a56340f81ea2b2705ca88410b05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69a5c4ae27dc8e859a4559f7ab87a64047c4bfc814feb1cad3797354fa1ec640\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"6a0d797d1227aea5a12ff538434df469ef05a7ee401db7c39bb0fa7ad123fc05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d510d6bf0d02874963a62f4afffe682ebeae86d1b80d2d425407ccc8c330178\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"347354855c1cdb5b67fa9f1d8a7f959defe6cae096340721398863336ae3ed34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"49e148bcf8f3bd2320a8439c08fcf37e06f12f8a4f69ec3c353f67550d3c27f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"c938cec593e991bc11fb1e3e7d118212dd2cb0dfc7e2c72afa98668a7d51f0ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"42536036e7512c2feb811866135cccb636f11d9d8e3893b6c36572e31a8f7ae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"4819524beeef438ba69edd6a29f6fd07038bd94a981aa7439997d5794bbe247c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9adcdbd5184b289f728f65383fd5d52ff78e1bc7d5611b2e6cf173973bdeead9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"ed40a51de12529d09ac83585257509f6204e9180065f98bcb699f8c7c0e8ed89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f90d7884754022fc6fd47e26b90b936c61fb56290c06901e170266181d02645\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0dda7b01\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"694e00081bc1fbd9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/auth-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w1-e6c59a/maas-trlp-auth-test-model-e6c59a\"]}],\"name\":\"a5abc5facb24858219d784b5389f25878b7a5ad49b78280da4a43376d9230f03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w1-e6c59a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:56:07.341Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-e6c59a","namespace":"ai-tenant-e2e-shared-a-w1-e6c59a","uid":"7f169fbf-ab0e-45c1-b354-215d8b8567c9","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:56:07.709Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress","uid":"bdb28298-f8ad-43b5-9aa4-51c38ea3fda9","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:56:08.539Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w1-7cdb6d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w1-7cdb6d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:56:08.938Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:08.938Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:56:09.093Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-e6c59a-kserve-route","namespace":"ai-tenant-e2e-shared-a-w1-e6c59a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-e6c59a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:56:17.909Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","AuthPolicy","Limitador","EnvoyFilter","HTTPRoute"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-11-04T00:56:18.312Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:20.240Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:56:20.432Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:56:20.432Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:24.462Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:24.462Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:56:24.528Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:56:24.533Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:56:24.552Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:24.552Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:24.721Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:28.104Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:28.104Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9dcd85","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9dcd85","reconcileID":"d27a9e2a-da85-40ba-89f0-151567c15c23","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-9dcd85","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:56:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9dcd85","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:56:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9dcd85","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9dcd85","reconcileID":"c8842132-1e73-415c-bffb-4b2f2a7ddf89","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-9dcd85","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9dcd85","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:56:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:56:40.593Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"update":21}}
{"level":"info","ts":"2026-11-04T00:56:40.997Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:43.217Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:56:43.449Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:56:43.449Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:44Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-fc376d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-fc376d","reconcileID":"7feadb64-87b1-42e7-acc2-b5ea0cd038bc","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-fc376d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:56:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-fc376d","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:56:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:56:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:56:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:56:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:56:46Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-fc376d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-fc376d","reconcileID":"2a37c432-1883-41de-8c26-e021c2f8625d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-fc376d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:56:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-fc376d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:56:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:56:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:56:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:56:47Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:56:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:56:47.658Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:56:47.663Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:47.731Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:56:47.741Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:56:47.741Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:47.747Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:47.747Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:51.597Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:51.597Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:56:52.409Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-fc376d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-fc376d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:56:52.865Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-c2b75d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-c2b75d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:56:53.744Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","TokenRateLimitPolicy","HTTPRoute","Kuadrant"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-04T00:56:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-c2b75d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-c2b75d","reconcileID":"1361b78a-45a4-4cf9-af41-49cadf3bbbeb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-c2b75d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:56:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-c2b75d","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:56:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:56:54.055Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:54.075Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:56:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:56:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:56:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:56:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-c2b75d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-c2b75d","reconcileID":"a3b43261-1e0e-4552-8092-88d0c04a08cd","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-c2b75d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:56:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-c2b75d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:56:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:56:58.246Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:58.320Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:56:58.444Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:56:58.444Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:56:58Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:56:58Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:56:58Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:56:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:56:58.726Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:57:03.560Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:57:03.563Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:03.649Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:57:03.651Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:57:03.732Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:03.732Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T00:57:03.738Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-9dcd85","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-extmod-a-9dcd85","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-9dcd85","uid":"d9f46d65-2cd0-4341-9eb1-5c6559ae3432"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-9dcd85"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-a-9dcd85\" already exists"}
{"level":"error","ts":"2026-11-04T00:57:03.759Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:57:03.759Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:57:03.834Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d12ff10d52b48233c19304894a2d4c3cc4c077f081e19fbdd1a6d661688b6f12","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d12ff10d52b48233c19304894a2d4c3cc4c077f081e19fbdd1a6d661688b6f12"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d12ff10d52b48233c19304894a2d4c3cc4c077f081e19fbdd1a6d661688b6f12\" already exists"}
{"level":"error","ts":"2026-11-04T00:57:03.914Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"63bf2490a0824f3a424555cd0901f5616e83693d7cdbfac9213dc64077e59ed2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["63bf2490a0824f3a424555cd0901f5616e83693d7cdbfac9213dc64077e59ed2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"63bf2490a0824f3a424555cd0901f5616e83693d7cdbfac9213dc64077e59ed2\" already exists"}
{"level":"error","ts":"2026-11-04T00:57:04.017Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0f26d61597ba6588e89dcf0243286c409403f13e89019c53d08f83cf981398be","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0f26d61597ba6588e89dcf0243286c409403f13e89019c53d08f83cf981398be"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0f26d61597ba6588e89dcf0243286c409403f13e89019c53d08f83cf981398be\" already exists"}
{"level":"error","ts":"2026-11-04T00:57:04.110Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"53cb2d82397779f499f03abf281d9b82427dd42d38969609b5c621e64539f464","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["53cb2d82397779f499f03abf281d9b82427dd42d38969609b5c621e64539f464"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"53cb2d82397779f499f03abf281d9b82427dd42d38969609b5c621e64539f464\" already exists"}
{"level":"error","ts":"2026-11-04T00:57:04.199Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"371ac9e05baf3d8b98cf693c371c8770fa31c133a1f5bd788099e4b05fc7204f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["371ac9e05baf3d8b98cf693c371c8770fa31c133a1f5bd788099e4b05fc7204f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"371ac9e05baf3d8b98cf693c371c8770fa31c133a1f5bd788099e4b05fc7204f\" already exists"}
{"level":"error","ts":"2026-11-04T00:57:04.298Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"60bc89b52ad97ae18a9b348b3fc41864798ed2025a4d40c10e8730e5ecdb2b25","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["60bc89b52ad97ae18a9b348b3fc41864798ed2025a4d40c10e8730e5ecdb2b25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9dcd85.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"60bc89b52ad97ae18a9b348b3fc41864798ed2025a4d40c10e8730e5ecdb2b25\" already exists"}
{"level":"error","ts":"2026-11-04T00:57:04.592Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-9dcd85","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-extmod-a-9dcd85","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-9dcd85","uid":"d9f46d65-2cd0-4341-9eb1-5c6559ae3432"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63bf2490a0824f3a424555cd0901f5616e83693d7cdbfac9213dc64077e59ed2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9dcd85-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]}],\"name\":\"819e99e202134acaed4162df00e775686464e4f26f7b437b72b97676baf7bd48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"371ac9e05baf3d8b98cf693c371c8770fa31c133a1f5bd788099e4b05fc7204f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9dcd85-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]}],\"name\":\"febb98317700a124c7e1a9d5c3897616a2d45432d3037ed11ddfb682e4463f08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f26d61597ba6588e89dcf0243286c409403f13e89019c53d08f83cf981398be\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9dcd85-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]}],\"name\":\"ba9ef89e20fde80453887506a27f606bc8216cba4ad79f589d476b269198c015\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60bc89b52ad97ae18a9b348b3fc41864798ed2025a4d40c10e8730e5ecdb2b25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9dcd85-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]}],\"name\":\"c1421b04d6d22f9ba89c393a43d5f41f5f55c155a4e164883f6206b29f7ea732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"53cb2d82397779f499f03abf281d9b82427dd42d38969609b5c621e64539f464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9dcd85-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]}],\"name\":\"68cc6342e1df75304ddbbdbe9c20c1daaf0448425bdbf058c08ca2a18b39ec60\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d12ff10d52b48233c19304894a2d4c3cc4c077f081e19fbdd1a6d661688b6f12\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9dcd85-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2dde068e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9dcd85\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9dcd85\"]}],\"name\":\"551d840b22d64f70ab68eef4bb666e9d9c8f6535f2aed87c4793a3dd3d55de84\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-9dcd85"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-a-9dcd85\" already exists"}
{"level":"error","ts":"2026-11-04T00:57:05.786Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-9dcd85","namespace":"openshift-ingress","uid":"e1206bf4-52b8-40a1-8983-b23ce5bb5536","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-9dcd85\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:05.845Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:05.904Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:05.907Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w1-7cdb6d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w1-7cdb6d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:05.965Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.086Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.145Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.203Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-77b30e","namespace":"openshift-ingress","uid":"e2ce646e-fd6d-4d3a-a655-a32e1849acfc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-77b30e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.385Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.444Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress","uid":"8ee23743-8136-414a-befd-4823f1204662","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w1-7cdb6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.564Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.623Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.682Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.741Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-3fb57a","namespace":"openshift-ingress","uid":"7a668681-cdf4-44fd-b368-9ec8295e9699","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-3fb57a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.801Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.860Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-e6c59a","namespace":"ai-tenant-e2e-shared-a-w1-e6c59a","uid":"7f169fbf-ab0e-45c1-b354-215d8b8567c9","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.919Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:06.978Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:07.023Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-9dcd85-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-extmod-a-9dcd85-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:07.037Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:07.096Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:07.155Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:07.214Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:07.395Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress","uid":"e60092a7-20f9-454d-9d25-16747f42d38f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-fb2a9a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:07.515Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:07.575Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:57:07.575Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:07.575Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:57:07.881Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-9dcd85","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-9dcd85\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:07.898Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-extmod-a-9dcd85","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-extmod-a-9dcd85\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:08.740Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-c2b75d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-c2b75d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:57:09.142Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-fc376d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-fc376d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:57:16.581Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","EnvoyFilter","AuthPolicy","HTTPRoute","Kuadrant","Limitador","ConfigMap","Gateway"],"eventTypes":{"create":16,"update":33}}
{"level":"info","ts":"2026-11-04T00:57:17.035Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:17.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:20.727Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:57:21.028Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:57:21.147Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:57:21.258Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:57:21.258Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:57:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","reconcileID":"9606fc48-dabd-4176-acbd-c4b959913495","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:57:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","event":"CREATE"}
{"level":"info","ts":"2026-11-04T00:57:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:57:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T00:57:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T00:57:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:57:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","reconcileID":"b8a5e1ca-1f01-45a7-9d54-773d516427fa","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:57:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:57:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:57:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:57:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:57:23Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:57:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:57:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","reconcileID":"f7b5ddd8-731d-49ce-98f4-ded48e8a4e17","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:57:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:57:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:57:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T00:57:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T00:57:25Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T00:57:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:57:25.860Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:57:25.862Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:25.923Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:57:25.939Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:57:25.943Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:25.943Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:57:26.071Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:57:30.460Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:30.460Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:57:31.867Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-b13ae9","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-b13ae9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:57:40.504Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","AuthPolicy","AuthConfig","EnvoyFilter","Gateway","Kuadrant","ConfigMap","Limitador"],"eventTypes":{"create":21,"update":41}}
{"level":"info","ts":"2026-11-04T00:57:40.979Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:40.999Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:46.335Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:57:46.413Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:57:46.429Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:57:46.648Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:57:46.648Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:57:51.148Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:57:51.154Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:51.162Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:57:51.163Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:51.163Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:57:51.165Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T00:57:51.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:57:51.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T00:57:54.608Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-e6c59a","namespace":"ai-tenant-e2e-shared-a-w1-e6c59a","uid":"7f169fbf-ab0e-45c1-b354-215d8b8567c9","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-e6c59a\" not found"}
{"level":"error","ts":"2026-11-04T00:57:54.982Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-7cdb6d","namespace":"ai-tenant-e2e-shared-b-w1-7cdb6d","uid":"d723adbb-1926-406f-8d2b-de0e1c3a687a","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-7cdb6d\" not found"}
{"level":"info","ts":"2026-11-04T00:57:55.481Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:57:55.481Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:05.379Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","AuthConfig","AuthPolicy","Gateway","HTTPRoute","Limitador","ConfigMap"],"eventTypes":{"create":9,"delete":3,"update":13}}
{"level":"info","ts":"2026-11-04T00:58:05.869Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:09.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:58:10.014Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:58:10.014Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:14.040Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:58:14.040Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:14.052Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:58:14.054Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:58:14.068Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:14.068Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:14.334Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:19.113Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:19.113Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:28.430Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","ConfigMap","Limitador","AuthPolicy","EnvoyFilter","HTTPRoute"],"eventTypes":{"delete":12,"update":35}}
{"level":"info","ts":"2026-11-04T00:58:28.730Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:31.225Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:58:31.438Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:58:31.438Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:35.972Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:58:36.014Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:58:36.026Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:36.033Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:58:36.033Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:36.039Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:36.039Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:40.058Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:40.058Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:49.236Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Gateway","AuthPolicy","Limitador"],"eventTypes":{"create":1,"update":31}}
{"level":"info","ts":"2026-11-04T00:58:49.516Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:52.457Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:58:52.648Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:58:52.648Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:56.960Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:58:56.977Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:56.977Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:58:56.977Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:58:56.978Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:58:57.016Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:58:57.016Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:59:00.987Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:00.987Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:59:01.738Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-noten-fae303","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-noten-fae303\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:59:02.448Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w1-7cdb6d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w1-7cdb6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:59:10.380Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","HTTPRoute"],"eventTypes":{"create":1,"delete":1,"update":3}}
{"level":"info","ts":"2026-11-04T00:59:17.138Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:17.146Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T00:59:17.158Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:59:17.138Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:59:17.242Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:17.242Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:59:17.336Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:59:21.257Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:21.257Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T00:59:30.358Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","EnvoyFilter","Limitador","AuthConfig"],"eventTypes":{"delete":12,"update":30}}
{"level":"info","ts":"2026-11-04T00:59:30.761Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:32.757Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:59:32.925Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:59:32.925Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-77b30e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-77b30e","reconcileID":"45fd1fbb-b8d5-44db-8a75-32d2edc9bde3","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-77b30e","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-77b30e","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:59:37.447Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:37.447Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T00:59:37.448Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:37.449Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T00:59:37.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T00:59:37.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-77b30e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-77b30e","reconcileID":"45fd1fbb-b8d5-44db-8a75-32d2edc9bde3","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-77b30e","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-77b30e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-77b30e","reconcileID":"360f65bd-cddb-4c4c-80b7-a6c47d17285a","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-77b30e\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-77b30e","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-77b30e\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:59:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","reconcileID":"265ed8e8-f0e9-4317-9491-201bc142ed2c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","reconcileID":"265ed8e8-f0e9-4317-9491-201bc142ed2c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-fb2a9a","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-fb2a9a\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:59:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9dcd85","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9dcd85","reconcileID":"84dd5754-7d82-497a-bfa5-d64ec2f4754e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-9dcd85","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9dcd85","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9dcd85","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9dcd85","reconcileID":"84dd5754-7d82-497a-bfa5-d64ec2f4754e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-9dcd85","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9dcd85","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9dcd85","reconcileID":"d54954b3-d9d8-4736-a313-bcf6b181fad8","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-9dcd85\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9dcd85","event":"DELETE"}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-9dcd85\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T00:59:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T00:59:39.835Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-fb2a9a","namespace":"openshift-ingress","uid":"e60092a7-20f9-454d-9d25-16747f42d38f","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-fb2a9a\" not found"}
{"level":"error","ts":"2026-11-04T00:59:40.078Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-77b30e","namespace":"openshift-ingress","uid":"e2ce646e-fd6d-4d3a-a655-a32e1849acfc","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-77b30e\" not found"}
{"level":"error","ts":"2026-11-04T00:59:40.915Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-9dcd85-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-a-9dcd85-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T00:59:41.810Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-9dcd85","namespace":"openshift-ingress","uid":"e1206bf4-52b8-40a1-8983-b23ce5bb5536","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-9dcd85\" not found"}
{"level":"info","ts":"2026-11-04T00:59:41.811Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:41.811Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T00:59:41.873Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-fb2a9a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-fb2a9a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T00:59:42.018Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-noten-fae303","error":"gateways.gateway.networking.k8s.io \"e2e-noten-fae303\" not found"}
{"level":"error","ts":"2026-11-04T00:59:43.278Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-9dcd85","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-a-9dcd85\" not found"}
{"level":"error","ts":"2026-11-04T00:59:43.338Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-77b30e","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-77b30e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T00:59:54.825Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","HTTPRoute","Limitador","EnvoyFilter","Kuadrant","Gateway","AuthPolicy"],"eventTypes":{"create":1,"delete":14,"update":33}}
{"level":"info","ts":"2026-11-04T00:59:55.248Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:55.271Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T00:59:58.856Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T00:59:58.937Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T00:59:59.127Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T00:59:59.127Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T00:59:59.418Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:00:03.838Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:00:03.840Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:03.852Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:00:03.864Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:00:03.917Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:03.917Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:00:04.071Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","reconcileID":"297cdde9-c0eb-4d88-938d-09e08a06e3ab","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","reconcileID":"297cdde9-c0eb-4d88-938d-09e08a06e3ab","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-3fb57a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-3fb57a","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-3fb57a\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:00:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T01:00:15.534Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-3fb57a-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-a-3fb57a-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:00:16.285Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-3fb57a","namespace":"openshift-ingress","uid":"7a668681-cdf4-44fd-b368-9ec8295e9699","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-3fb57a\" not found"}
{"level":"info","ts":"2026-11-04T01:00:16.517Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:16.517Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:00:17.276Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-3fb57a","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-a-3fb57a\" not found"}
{"level":"info","ts":"2026-11-04T01:00:18.494Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthPolicy","Gateway"],"eventTypes":{"delete":8}}
{"level":"info","ts":"2026-11-04T01:00:20Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","reconcileID":"48963fcd-81dd-4a04-8c4b-9c97fcfc1f4a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:00:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:00:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:00:20Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:00:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:00:21Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:00:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","reconcileID":"48963fcd-81dd-4a04-8c4b-9c97fcfc1f4a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-b13ae9","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:00:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-b13ae9","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:00:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:00:21Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-b-b13ae9\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:00:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:00:26.160Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:00:26.165Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:26.171Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:00:26.172Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:00:26.173Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:26.173Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:00:26.276Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:00:26.276Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:00:26.280Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","resourceVersion":"60900","uid":"1ed933c4-6946-4544-8f9c-f46f7e0d062a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:26.352Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-dft-892a8f-29eeda5604fd","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-892a8f-29eeda5604fd#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"412d1c0391928ff01a3a7ed7f70ab10779d5b8380e513bd9e8b0398a8611ab47","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["412d1c0391928ff01a3a7ed7f70ab10779d5b8380e513bd9e8b0398a8611ab47"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"412d1c0391928ff01a3a7ed7f70ab10779d5b8380e513bd9e8b0398a8611ab47\" already exists"}
{"level":"error","ts":"2026-11-04T01:00:26.417Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","resourceVersion":"60969","uid":"c7ad77a2-8814-49ae-98b8-eea0745f2dea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:26.513Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","resourceVersion":"61003","uid":"d7362fcf-6346-4177-8a82-a502664af493"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:26.613Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","resourceVersion":"60869","uid":"b33246e7-0352-41d5-aeda-06370c4f2104"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:26.679Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","resourceVersion":"60671","uid":"11563e4d-bd42-439e-953f-44d0dd5d96c5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:26.746Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","resourceVersion":"60830","uid":"f8baf538-8b91-4b9d-93b4-3eb2ffb3dc44"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:26.811Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:54Z"}],"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","resourceVersion":"60735","uid":"7dd02dee-21f8-4e8f-8bcf-34f7283568b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:26.876Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","resourceVersion":"60952","uid":"eab2a7f4-0d1f-4109-b660-70398295531e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:26.942Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","resourceVersion":"60681","uid":"c1d0e4d7-4c7d-4727-a7b1-d4a8f60ffa63"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.007Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","resourceVersion":"61016","uid":"ea93d085-96bb-46ba-9258-16618433a0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.072Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system","resourceVersion":"61007","uid":"da925041-7e60-4173-a86b-d5b45301b805"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.138Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","resourceVersion":"60949","uid":"7ee97d41-8f87-4354-84af-b7e57b6b4bd3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.203Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:35Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","resourceVersion":"61004","uid":"4cb69f08-179a-469d-b779-b7042c6da4e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.269Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","resourceVersion":"60833","uid":"88066b40-e72f-45c3-9518-f4d65e7c02ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.336Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:54Z"}],"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","resourceVersion":"60740","uid":"bed19aa4-37ac-48f3-890d-4584e37ea205"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.709Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","resourceVersion":"60846","uid":"4aeba8f0-1b34-4470-8415-8c1009b56810"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.810Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","resourceVersion":"61012","uid":"6e833789-6bea-4b55-9954-107673397cb1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.822Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:04:16Z","generation":14,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"af1b8c6b-0ceb-4134-aa61-de1746b60d18\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:30:42Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"af1b8c6b-0ceb-4134-aa61-de1746b60d18"}],"resourceVersion":"64592","uid":"edcce1ea-eb55-46d5-a2c7-9f7dda82aae1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33602ef9cfbf5688c71c3298c4b4d3515aebfa579fc31420efb58d0318bb31a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44fe9abee7cf8648fb25d1ca043e3d21a9bea8c6af604389966c34186ba0c8ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-892a8f')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-892a8f/llm/e2e-dft-892a8f-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"412d1c0391928ff01a3a7ed7f70ab10779d5b8380e513bd9e8b0398a8611ab47\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"760bff2fc8ff1a814ad32d47e79e85db65bd92b7459ecd53cf056afb2552deb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-892a8f')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6bd414c9c9359b65f02a8143d74549f89742cc5a5f2b1c5e5c4af3377d22138d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"107aec6ac184e792bc7986fc0b594cec21ba4b71e2c09b5039e77d4a9954f447\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-892a8f')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-892a8f/llm/e2e-dft-892a8f-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de279b2b92af88cacd6721681dbdce668019e822233ea14ae85de9993e23faac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9173c1c3cc3a981be1581e7fbea556bfd5100457f95cac9b238701b78985633\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-892a8f')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.877Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system","resourceVersion":"60982","uid":"62c7cacb-180e-4c90-b5d6-1c407e60ad8d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:27.943Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","resourceVersion":"60867","uid":"29639e67-1f6c-4127-bcb9-cce9ff973a39"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.009Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:56Z"}],"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","resourceVersion":"60781","uid":"6a0aa075-2a97-4b6b-8291-ea7177f180e8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.075Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","resourceVersion":"60889","uid":"680a2fbe-042b-4b0d-967b-f9c50d18d20c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.144Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","resourceVersion":"61019","uid":"a3cd9798-35c5-4e84-8035-49d9651e7466"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.185Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-3fb57a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:54:34Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"02ab6895-4128-4f54-a22d-0b96ddb803f7\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:54:34Z"}],"name":"kuadrant-e2e-extmod-a-3fb57a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-3fb57a","uid":"02ab6895-4128-4f54-a22d-0b96ddb803f7"}],"resourceVersion":"103241","uid":"1defb7e1-6627-44af-8363-7f5394c8248c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7eea6e2791d376acd637210650098a3be728094cbe9ee165919cc2788e4fa3d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-3fb57a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]}],\"name\":\"74d1ab7d1f34cce9cdc2381a30d3f3668effa2b41b69667f6c4accac07b5d93e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7434c525398ef18b2754cc8b02eab6a914b2544ef7a15d1678f1fb826db6e51\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-3fb57a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]}],\"name\":\"12f1547bd7f54c29b6b563db909576a89dbbe6b628eae9fb52202772f58bfee7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfbac4bd77397f0d51bef18e04f0c55c642962e166d19eed9407b555d7653621\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-3fb57a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]}],\"name\":\"9ab289a46e3ecf87bf130aeefcad56420cead7871e01ca764aa3d2972f4afc5d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0274fcc402802c62d1e6cc91869e9e156a3de99b84a6a5b016cd6d5c1c57a1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-3fb57a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]}],\"name\":\"d83adb51dd47abce66bafbde2b6015801e436bff04da4c467018b1e76cb5aef7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"759e854dbd94d9d99df7285cf7167a65ff3e2e78da2562aa81d0a0c515f76b7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-3fb57a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]}],\"name\":\"14f6bf4d2a2cd41b4a204d72fd37c20e9ec30556f2784f34f26acb9172edbf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"980b11bba04d0759be3a8f1a3c631f1124b0280b2310cb7d499cbf75afcfbce7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-3fb57a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__03b9d148\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-3fb57a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-3fb57a\"]}],\"name\":\"7a00e4a931478750915aed58df588c686642af429768fbff6fefca32ec694895\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-3fb57a"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-a-3fb57a\" not found"}
{"level":"error","ts":"2026-11-04T01:00:28.217Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-dft-892a8f-29eeda5604fd","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-892a8f-29eeda5604fd#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"de279b2b92af88cacd6721681dbdce668019e822233ea14ae85de9993e23faac","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de279b2b92af88cacd6721681dbdce668019e822233ea14ae85de9993e23faac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"de279b2b92af88cacd6721681dbdce668019e822233ea14ae85de9993e23faac\" already exists"}
{"level":"error","ts":"2026-11-04T01:00:28.282Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","resourceVersion":"60930","uid":"df6222c5-f966-4567-b1d3-714862434505"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.351Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","resourceVersion":"60881","uid":"6327ba77-94b6-4bbb-bc8a-f883ff4a36e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.417Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","resourceVersion":"60686","uid":"1a9f71de-b6a8-4351-92e5-78cbcf89ab07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.460Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-extmod-b-b13ae9","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:57:52Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"903c66ab-e98c-4333-a8f2-7a750dbde948\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:57:52Z"}],"name":"kuadrant-e2e-extmod-b-b13ae9","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-b-b13ae9","uid":"903c66ab-e98c-4333-a8f2-7a750dbde948"}],"resourceVersion":"107800","uid":"20842cdc-ef72-43c1-ae22-586b03b486ba"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d828a036ee20acbee515878acb32cfd886fb202764d59ca788ea8bb8c7097b02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-b13ae9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]}],\"name\":\"d816eda7a04237bd034e371c6bffc6e5580b12caf158f6f1c5842bbc5997622c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e3b79b89489a8c1a3abd307355ca53dc670696f1a4a4dd36ac93abedf7c6c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-b13ae9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]}],\"name\":\"936a21f9f0da1e65cdd50fccec530c0dddd0940ac6365e99b08dd3975898a856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"55eb1430a8f5ac0154f43ba58510c5dc4f5ae5e4162fc2fdbffc6f4ad2f4ba25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-b13ae9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]}],\"name\":\"6e175cd77f000cd08f6d73fa749297b42f256737eb9742267b6e27834bdaecc1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ea5e5fede609530d55eaaa2f2e8ca9c87a925bfd5ec04788a8024f660b59128\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-b13ae9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]}],\"name\":\"549b58b151b524aa88bda636f78d60c92a8858b079a0f3163b7b9668d88bfe91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e9208303608f73cd0cf16bf949d95c7328eecf4cfa4627e8fc12bcc2c7bc381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-b13ae9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]}],\"name\":\"63ff515bb15897a10627cbe6abeda5fcba7910a2ffdcd9ad35cc912c80f403d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"24c24600f0d811e40eb98dd1cd6412c60b9a071c1cd4088b3282ba23330d716a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-b13ae9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__05f515b7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-b13ae9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-b13ae9\"]}],\"name\":\"05b7d1b60f8b27080e64b26c39cde90d9f576bbb605bc0e7a9c3e9842dfa096e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-b-b13ae9"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-b-b13ae9\" not found"}
{"level":"error","ts":"2026-11-04T01:00:28.483Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","resourceVersion":"60988","uid":"4789dc1d-0b51-4a6f-b176-5aee3fa5eb1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.548Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","resourceVersion":"60864","uid":"82865439-7052-4692-af5e-0f30c505ccb7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.614Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","resourceVersion":"60682","uid":"4df3ee09-24f5-46d6-af83-5d91cc9b6a3f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.680Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","resourceVersion":"60939","uid":"97d1e99e-db75-43ed-8e5c-d1ef7cbfcc8a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.745Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:52Z"}],"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","resourceVersion":"60662","uid":"5831c0c9-aa0b-49df-8c40-8305c69bb008"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.811Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:03Z"}],"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","resourceVersion":"61043","uid":"a734419e-fb72-4d8c-8726-0cf49c79903b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:29:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:29:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.876Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","resourceVersion":"60976","uid":"5259cba1-fb24-4243-b768-481e6b8a2f74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:28.943Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:03Z"}],"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","resourceVersion":"61022","uid":"0790ee5c-e21f-4d7b-a394-c30498d06200"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.009Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","resourceVersion":"60873","uid":"45307783-5fa5-44e4-9063-d54dd5c04711"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.075Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:52Z"}],"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","resourceVersion":"60645","uid":"7290bf08-747f-4535-bdb4-b77f131ebf07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.141Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","resourceVersion":"60811","uid":"f0b58eae-b5a7-4dc6-88bf-c1cb6e8b2bb6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:37Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:37Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.208Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","resourceVersion":"60994","uid":"05c7120a-82ee-4fee-846a-4e3841beb2e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.276Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","resourceVersion":"60965","uid":"f5aa5634-1eef-4c83-9de8-beb2bea42b54"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.343Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","resourceVersion":"60851","uid":"bdcf0562-2434-42f0-af93-c1f674e609f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.410Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","resourceVersion":"60842","uid":"b7d3a13b-e331-4e9f-a8d3-441262d963cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.476Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:55Z"}],"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","resourceVersion":"60745","uid":"ce55126a-2797-4172-b44f-58d5fa61ef97"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:55Z"}],"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","resourceVersion":"60748","uid":"603b420f-4ff7-4b67-99f4-1e8d3f9cbcf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.607Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":"2026-11-04T00:04:15Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:56Z"}],"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system","resourceVersion":"60799","uid":"4b4b4404-04ab-47e7-9b6a-155abf48ee04"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.672Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","resourceVersion":"60849","uid":"91fc9973-eae8-42fa-8bdc-767a7bbb76d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.737Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system","resourceVersion":"60684","uid":"2bfa8997-be7f-413c-adee-59c5f62ebf9a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.802Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","resourceVersion":"60941","uid":"436fe831-e0eb-4ef6-ba18-665342a6c7f4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.867Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","resourceVersion":"60808","uid":"f67432a6-d4fc-4453-9f0c-4f3e66d88a3d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:29.935Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","resourceVersion":"60898","uid":"0c2279be-f80c-43ce-aa74-c6c4374682cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.007Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:08Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:54Z"}],"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","resourceVersion":"60727","uid":"8d56271a-0715-4609-9700-c88e7b27e0fe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.073Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","resourceVersion":"60944","uid":"41c72840-cfaa-4309-bd59-f64cab0d82da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.139Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","resourceVersion":"60668","uid":"8fea2396-6c61-4b0e-897e-a9ba0e797161"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.204Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","resourceVersion":"60892","uid":"f659bddd-ccbc-4880-9d50-b3379269187a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.269Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:56Z"}],"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","resourceVersion":"60795","uid":"d7bcc5f6-9218-414f-b4a3-f8e8f42a7ea6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.334Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","resourceVersion":"60979","uid":"591b2c08-f8dd-44ee-85ae-148c50d87e9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.398Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","resourceVersion":"60857","uid":"0f705ecf-bf9f-42c5-923c-9bcdb55dd17c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.464Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","resourceVersion":"60913","uid":"f4130945-c9d0-41b2-a0a6-41cb06e58f4e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","resourceVersion":"60674","uid":"46cd51d3-5f06-4d20-b71e-1f0b4db592de"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.595Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","resourceVersion":"60993","uid":"4b310763-fcf4-40d4-b60d-82c26edb4d30"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.660Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","resourceVersion":"60885","uid":"4b122b12-2473-4ae0-9741-fd52f84809db"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.725Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","resourceVersion":"60996","uid":"81514f4e-cb8f-4022-b596-09cf37bd31d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.791Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","resourceVersion":"60999","uid":"745d7dea-a67a-4a7b-907d-673608c2af48"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.862Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-dft-892a8f-29eeda5604fd","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-892a8f-29eeda5604fd#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"33602ef9cfbf5688c71c3298c4b4d3515aebfa579fc31420efb58d0318bb31a7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["33602ef9cfbf5688c71c3298c4b4d3515aebfa579fc31420efb58d0318bb31a7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"33602ef9cfbf5688c71c3298c4b4d3515aebfa579fc31420efb58d0318bb31a7\" already exists"}
{"level":"error","ts":"2026-11-04T01:00:30.927Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","resourceVersion":"60677","uid":"2ebc719a-5efd-4f44-8a8b-a20427dd08a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:30.993Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","resourceVersion":"60896","uid":"5aecf4b8-cefb-471c-94ac-d3451688a75b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.063Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-dft-892a8f-29eeda5604fd","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-892a8f-29eeda5604fd#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6bd414c9c9359b65f02a8143d74549f89742cc5a5f2b1c5e5c4af3377d22138d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6bd414c9c9359b65f02a8143d74549f89742cc5a5f2b1c5e5c4af3377d22138d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6bd414c9c9359b65f02a8143d74549f89742cc5a5f2b1c5e5c4af3377d22138d\" already exists"}
{"level":"error","ts":"2026-11-04T01:00:31.128Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","resourceVersion":"60921","uid":"8f728668-caee-43f7-9724-558cf8503a70"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.196Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","resourceVersion":"61001","uid":"28feee4f-561a-4d63-9877-c5bb7ff4d572"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.261Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","resourceVersion":"60936","uid":"28091510-d93c-4962-92f3-527e9404502d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.326Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","resourceVersion":"60938","uid":"991fcc4c-9d1b-4b64-a94d-e09ed894da1f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.390Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","resourceVersion":"61009","uid":"c6683eb7-c87e-4ca2-82c1-0a26a13c0533"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.456Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:55Z"}],"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","resourceVersion":"60754","uid":"0a533f9a-db7f-40ac-b074-215a942699d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.522Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","resourceVersion":"60924","uid":"a3a8f190-0b70-4fce-975e-ca63be466540"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.587Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","resourceVersion":"60860","uid":"4789cda5-d34c-48f9-9bdd-b029016fb3a4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.652Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system","resourceVersion":"60961","uid":"a0647f68-e21f-4ae8-a007-876e4afcedc1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.717Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","resourceVersion":"60663","uid":"749db18a-efd0-45ab-9944-de1d056f97d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.782Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","resourceVersion":"60854","uid":"e8d2a952-464c-46fe-a26d-8065101e10ba"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.848Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","resourceVersion":"60917","uid":"2e63465b-6b28-4996-9d9f-439009fe7879"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.913Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","resourceVersion":"60840","uid":"5294372c-e0b1-4ea7-952e-b2054adcabed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:31.979Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","resourceVersion":"60974","uid":"225cedac-fad9-4cca-aea2-ff0dda2db89d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.045Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system","resourceVersion":"60967","uid":"94e84cfc-05a1-4a7a-9c7c-93cb02e3fb46"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.115Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","resourceVersion":"60907","uid":"5f83f408-3989-4587-955c-0d0e766e7b7c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.182Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","resourceVersion":"60883","uid":"e3004949-e35c-4e9b-a643-a948028f20b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.249Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:16Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:52Z"}],"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","resourceVersion":"60641","uid":"68046133-2e5e-4698-9fff-9ef40e5ac5d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.314Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","resourceVersion":"60871","uid":"efe4bf6b-05b6-403d-802c-6d695d0e65d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.379Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","resourceVersion":"60817","uid":"b1c16000-3633-41db-a343-82b238efb39f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.444Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","resourceVersion":"60862","uid":"a2510f1b-a9b0-4a9c-bb15-c4621eb0422a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.509Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","resourceVersion":"60698","uid":"5d17b531-e50a-4506-bef1-8eaa2cb8960f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.575Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:55Z"}],"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","resourceVersion":"60761","uid":"5199cd06-551e-406b-bee6-d4d24c5d5c84"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.641Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","resourceVersion":"61020","uid":"c8f8cd08-2a0f-4e20-a30b-5e6ca75dc31e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.706Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","resourceVersion":"60985","uid":"c0fe5844-d101-40b6-a43e-969837f9e0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.772Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","resourceVersion":"60828","uid":"f4ad64b4-da27-4c73-bd47-df0058b599ab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.837Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:01Z"}],"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","resourceVersion":"60977","uid":"9d1c31ae-1c67-4bcf-92ea-4206077e7438"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.903Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:59Z"}],"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","resourceVersion":"60909","uid":"f0ec2b4b-b236-463a-b2a5-84c3f9b4ade2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:32.969Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:02Z"}],"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","resourceVersion":"61014","uid":"b00ecfbf-ecc6-4817-b8c1-f0a5c174415a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.034Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:56Z"}],"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","resourceVersion":"60805","uid":"0d8715b8-d57a-454f-a76b-daeba49ae132"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.100Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","resourceVersion":"60826","uid":"5c3c058c-07cf-4597-81f0-f0a0e6273d1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.165Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","resourceVersion":"60933","uid":"3cadb7fb-34bb-4384-9baa-8b2e676dc6c0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.230Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:29:00Z"}],"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","resourceVersion":"60926","uid":"7fb18842-43f0-4afd-8bd4-52524a4d528d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.295Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:53Z"}],"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","resourceVersion":"60695","uid":"2e619d3e-8a68-4182-997f-3ea90cc450a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.361Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","resourceVersion":"60820","uid":"03510a5d-12ad-47ac-8aa3-861a3474a6ef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.427Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","resourceVersion":"60815","uid":"ffdd41f3-82af-40be-bb9b-040eb397f7ce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.494Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:52Z"}],"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","resourceVersion":"60658","uid":"544dcd98-b37d-4269-af23-0d4485bbca38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.560Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:58Z"}],"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","resourceVersion":"60877","uid":"9ab9be04-60a7-4454-ba4d-ca03f4b8f174"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.629Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:07Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:20:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:28:57Z"}],"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","resourceVersion":"60823","uid":"aae853cf-0a4e-4aeb-a9d1-e210ae871fc6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:33.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/371ac9e05baf3d8b98cf693c371c8770fa31c133a1f5bd788099e4b05fc7204f","error":"authconfigs.authorino.kuadrant.io \"371ac9e05baf3d8b98cf693c371c8770fa31c133a1f5bd788099e4b05fc7204f\" not found"}
{"level":"error","ts":"2026-11-04T01:00:33.744Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8510ca99a0e96b8da3db5c0eca4444b936bda8cda632bedf25fc88c3e711b6d4","error":"authconfigs.authorino.kuadrant.io \"8510ca99a0e96b8da3db5c0eca4444b936bda8cda632bedf25fc88c3e711b6d4\" not found"}
{"level":"error","ts":"2026-11-04T01:00:33.798Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4b6a49eb447bc0fe3b8779db8c6dfe1bdc053a95f68b0f718dea49b4ca486b4e","error":"authconfigs.authorino.kuadrant.io \"4b6a49eb447bc0fe3b8779db8c6dfe1bdc053a95f68b0f718dea49b4ca486b4e\" not found"}
{"level":"error","ts":"2026-11-04T01:00:33.855Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0f26d61597ba6588e89dcf0243286c409403f13e89019c53d08f83cf981398be","error":"authconfigs.authorino.kuadrant.io \"0f26d61597ba6588e89dcf0243286c409403f13e89019c53d08f83cf981398be\" not found"}
{"level":"error","ts":"2026-11-04T01:00:33.909Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ab4e2915f7436652ebc1b87c1b1f83dbe2dee961f67c9262985631a6ea861cba","error":"authconfigs.authorino.kuadrant.io \"ab4e2915f7436652ebc1b87c1b1f83dbe2dee961f67c9262985631a6ea861cba\" not found"}
{"level":"error","ts":"2026-11-04T01:00:33.964Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/02a9729bd906e6bfe9dc87cb4316cb2c880a9529d9fbb21b0bf02cc9aa110213","error":"authconfigs.authorino.kuadrant.io \"02a9729bd906e6bfe9dc87cb4316cb2c880a9529d9fbb21b0bf02cc9aa110213\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.018Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a5b145334b6e9166d6c3782dda3b59527696271d80db25c05c1eab88222ab400","error":"authconfigs.authorino.kuadrant.io \"a5b145334b6e9166d6c3782dda3b59527696271d80db25c05c1eab88222ab400\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.073Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/53cb2d82397779f499f03abf281d9b82427dd42d38969609b5c621e64539f464","error":"authconfigs.authorino.kuadrant.io \"53cb2d82397779f499f03abf281d9b82427dd42d38969609b5c621e64539f464\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.128Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e23cb006aa847097a65f7e5aac678e0f2bba1450934eb0dac5f536de16ba5c0e","error":"authconfigs.authorino.kuadrant.io \"e23cb006aa847097a65f7e5aac678e0f2bba1450934eb0dac5f536de16ba5c0e\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.183Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7ce85950cda604ae248786a9c505a02e4959f1c4a2034178c4af574e0d596ef0","error":"authconfigs.authorino.kuadrant.io \"7ce85950cda604ae248786a9c505a02e4959f1c4a2034178c4af574e0d596ef0\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.237Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/60bc89b52ad97ae18a9b348b3fc41864798ed2025a4d40c10e8730e5ecdb2b25","error":"authconfigs.authorino.kuadrant.io \"60bc89b52ad97ae18a9b348b3fc41864798ed2025a4d40c10e8730e5ecdb2b25\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.292Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/af7c39e11cc0681a19971cb4afbdccc67312a5b1225f0924f60c65fdda3a7635","error":"authconfigs.authorino.kuadrant.io \"af7c39e11cc0681a19971cb4afbdccc67312a5b1225f0924f60c65fdda3a7635\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.346Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d12ff10d52b48233c19304894a2d4c3cc4c077f081e19fbdd1a6d661688b6f12","error":"authconfigs.authorino.kuadrant.io \"d12ff10d52b48233c19304894a2d4c3cc4c077f081e19fbdd1a6d661688b6f12\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.401Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d8f17dac28fe030e6eaa270b68385342429054092a838a8d59d910c8b33a8d58","error":"authconfigs.authorino.kuadrant.io \"d8f17dac28fe030e6eaa270b68385342429054092a838a8d59d910c8b33a8d58\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.456Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/712420aaee3b32ae9661ad1acae3461f721cfbca7e44f989524a56dfcdb27dcd","error":"authconfigs.authorino.kuadrant.io \"712420aaee3b32ae9661ad1acae3461f721cfbca7e44f989524a56dfcdb27dcd\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.510Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/63bf2490a0824f3a424555cd0901f5616e83693d7cdbfac9213dc64077e59ed2","error":"authconfigs.authorino.kuadrant.io \"63bf2490a0824f3a424555cd0901f5616e83693d7cdbfac9213dc64077e59ed2\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.565Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b54086c09517b4307cdf6f69365630fb5144c707d63e6f753d962b9abb96efb8","error":"authconfigs.authorino.kuadrant.io \"b54086c09517b4307cdf6f69365630fb5144c707d63e6f753d962b9abb96efb8\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.620Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a050c2d85c9ae2e419235981acf7403b26d752305ceed6e1f0ac4b7184c8f901","error":"authconfigs.authorino.kuadrant.io \"a050c2d85c9ae2e419235981acf7403b26d752305ceed6e1f0ac4b7184c8f901\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.679Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:34.738Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:34.797Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:34.855Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:34.901Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-3fb57a-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-a-3fb57a-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:00:34.975Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.032Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-3fb57a","namespace":"openshift-ingress","uid":"7a668681-cdf4-44fd-b368-9ec8295e9699","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-3fb57a\" not found"}
{"level":"error","ts":"2026-11-04T01:00:35.273Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.332Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress","uid":"bdb28298-f8ad-43b5-9aa4-51c38ea3fda9","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.397Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.456Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.515Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.574Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.633Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-b-c2b75d","namespace":"openshift-ingress","uid":"d97481d6-9078-4323-9305-8dbeff3941f0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-b-c2b75d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.691Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress","uid":"8ee23743-8136-414a-befd-4823f1204662","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w1-7cdb6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.753Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-b-fc376d","namespace":"openshift-ingress","uid":"d790b850-fda1-4a2d-aca6-91c9c18ed22b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-b-fc376d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.814Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.816Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-b-b13ae9-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-b-b13ae9-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:00:35.884Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.895Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:35.943Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:36.002Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:36.183Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:36.241Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:36.301Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:36.360Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:36.417Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-b-b13ae9","namespace":"openshift-ingress","uid":"80fbe643-02e6-4981-bbf2-5359baee1ae2","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-b-b13ae9\" not found"}
{"level":"info","ts":"2026-11-04T01:00:36.418Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:36.418Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:00:36.478Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:36.560Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"external-model-e2e-dft-892a8f-29eeda5604fd","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"external-model-e2e-dft-892a8f-29eeda5604fd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:00:36.741Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-3fb57a","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-a-3fb57a\" not found"}
{"level":"error","ts":"2026-11-04T01:00:36.944Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-b13ae9","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-b-b13ae9\" not found"}
{"level":"info","ts":"2026-11-04T01:00:45.224Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","TokenRateLimitPolicy","Gateway","AuthPolicy","EnvoyFilter","Kuadrant","Limitador","ConfigMap"],"eventTypes":{"create":6,"delete":33,"update":131}}
{"level":"info","ts":"2026-11-04T01:00:45.826Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:45.913Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:49.028Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:00:49.124Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:00:49.132Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:00:49.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:00:49.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:00:52.978Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:00:52.990Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:52.992Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:00:53.018Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:53.018Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:00:53.022Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:00:53.124Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:00:53.124Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:00:57.129Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:00:57.129Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-fc376d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-fc376d","reconcileID":"ecdac228-0c4d-4870-8f0c-8b628cf37b1e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-fc376d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-fc376d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-fc376d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-fc376d","reconcileID":"ecdac228-0c4d-4870-8f0c-8b628cf37b1e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-fc376d","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-fc376d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-fc376d","reconcileID":"9cfe15a9-2644-4b14-b55f-3beacccba976","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-b-fc376d\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-fc376d","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-b-fc376d\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:01:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-c2b75d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-c2b75d","reconcileID":"50df3140-cacf-45f5-80db-c947a087cf4e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-c2b75d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-c2b75d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-c2b75d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-c2b75d","reconcileID":"50df3140-cacf-45f5-80db-c947a087cf4e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-c2b75d","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-c2b75d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-c2b75d","reconcileID":"3d5bdf6b-0a8a-484c-9ac3-df8653d609fb","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-b-c2b75d\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-c2b75d","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-b-c2b75d\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:01:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:01:10.768Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","AuthConfig","ConfigMap","EnvoyFilter","Limitador","HTTPRoute"],"eventTypes":{"create":4,"delete":12,"update":5}}
{"level":"info","ts":"2026-11-04T01:01:11.220Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:13.025Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:01:13.238Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:01:13.238Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:01:16.566Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:01:16.614Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:01:16.643Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:16.655Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:01:16.717Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:16.717Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:01:16.826Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:01:16.832Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-extmod-b-fc376d","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-b-fc376d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:16.937Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-extmod-b-fc376d","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-b-fc376d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:17.724Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-extmod-b-fc376d","envoyfilter":"openshift-ingress/kuadrant-e2e-extmod-b-fc376d","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-b-fc376d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:19.624Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-b-fc376d-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-b-fc376d-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T01:01:20.058Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:20.058Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:01:20.182Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-c2b75d","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-b-c2b75d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:20.519Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-fc376d","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-b-fc376d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:20.741Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:01:21.742Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":4,"update":3}}
{"level":"info","ts":"2026-11-04T01:01:22.052Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:22.072Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:25.645Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:01:25.931Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:01:26.039Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:01:26.359Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:01:26.359Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:01:29.373Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:01:29.377Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:29.449Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:29.449Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:01:29.460Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:01:29.461Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:01:29.523Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-extmod-b-c2b75d","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-b-c2b75d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.523Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-extmod-b-fc376d","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-b-fc376d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.552Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:01:29.552Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:01:29.613Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-extmod-b-fc376d","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-b-fc376d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.613Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-extmod-b-c2b75d","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-b-c2b75d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.613Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/07649b892bb6e4b64fe7eb16af29773c64d900a89d5a73b03981b15388647146","error":"authconfigs.authorino.kuadrant.io \"07649b892bb6e4b64fe7eb16af29773c64d900a89d5a73b03981b15388647146\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.668Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6905550882cb1090b1c05ff6e0633d529f04c309bc309d91cf1478d03f227c5b","error":"authconfigs.authorino.kuadrant.io \"6905550882cb1090b1c05ff6e0633d529f04c309bc309d91cf1478d03f227c5b\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.722Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9dd613726de7d772340a83e41ea842eed40fbd5d1ddbc16dbe8a695f8e797dfa","error":"authconfigs.authorino.kuadrant.io \"9dd613726de7d772340a83e41ea842eed40fbd5d1ddbc16dbe8a695f8e797dfa\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.776Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d8ec88596d7ae557780b76e7b1f0a39a3337c4d9ed02b30b13a44f957e9a2b3","error":"authconfigs.authorino.kuadrant.io \"7d8ec88596d7ae557780b76e7b1f0a39a3337c4d9ed02b30b13a44f957e9a2b3\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.831Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cf49672ecc5f52f8ddc4808b80bb96dca8e07bd835ef01db2966a539755ae2de","error":"authconfigs.authorino.kuadrant.io \"cf49672ecc5f52f8ddc4808b80bb96dca8e07bd835ef01db2966a539755ae2de\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.886Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/40b1fedcd49f9a227c9bbfee11c5a0cf0946daf4bdecdd0269edda5e6b945d91","error":"authconfigs.authorino.kuadrant.io \"40b1fedcd49f9a227c9bbfee11c5a0cf0946daf4bdecdd0269edda5e6b945d91\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b30733acb654d9565ebfba0d628d0c11c3e04ff098375b5f06ea44d8b24cd44f","error":"authconfigs.authorino.kuadrant.io \"b30733acb654d9565ebfba0d628d0c11c3e04ff098375b5f06ea44d8b24cd44f\" not found"}
{"level":"error","ts":"2026-11-04T01:01:29.995Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/17a1dd0348c460e1ab80f05a26136d99b3a1f27536f4b164f33d43ac37bfc220","error":"authconfigs.authorino.kuadrant.io \"17a1dd0348c460e1ab80f05a26136d99b3a1f27536f4b164f33d43ac37bfc220\" not found"}
{"level":"error","ts":"2026-11-04T01:01:30.044Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-extmod-b-fc376d","envoyfilter":"openshift-ingress/kuadrant-e2e-extmod-b-fc376d","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-b-fc376d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:30.049Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a791cd3e43a4a93480c5c32dc755e21e02fc5c6e5b7c2884e95881118c976819","error":"authconfigs.authorino.kuadrant.io \"a791cd3e43a4a93480c5c32dc755e21e02fc5c6e5b7c2884e95881118c976819\" not found"}
{"level":"error","ts":"2026-11-04T01:01:30.104Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/015d334c66e7608dc5fc8108a710d18fdbab401dc14c8e492a699e354a0739f7","error":"authconfigs.authorino.kuadrant.io \"015d334c66e7608dc5fc8108a710d18fdbab401dc14c8e492a699e354a0739f7\" not found"}
{"level":"error","ts":"2026-11-04T01:01:30.158Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/31c1eb78422548ee6218382b744e71f78c6f356580a51273d16a9a96216da450","error":"authconfigs.authorino.kuadrant.io \"31c1eb78422548ee6218382b744e71f78c6f356580a51273d16a9a96216da450\" not found"}
{"level":"error","ts":"2026-11-04T01:01:30.221Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c4d6e2f1c9aef671d4ecff93870dc47fd0a054fdf1d51fccf6f0cfa137c1276b","error":"authconfigs.authorino.kuadrant.io \"c4d6e2f1c9aef671d4ecff93870dc47fd0a054fdf1d51fccf6f0cfa137c1276b\" not found"}
{"level":"error","ts":"2026-11-04T01:01:30.280Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-extmod-b-c2b75d","envoyfilter":"openshift-ingress/kuadrant-e2e-extmod-b-c2b75d","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-b-c2b75d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:31.501Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:01:32.093Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-b-fc376d-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-b-fc376d-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:01:32.227Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-b-c2b75d-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-b-c2b75d-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T01:01:32.710Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:32.710Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:01:32.922Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-fc376d","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-b-fc376d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:33.135Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-c2b75d","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-b-c2b75d\" not found"}
{"level":"error","ts":"2026-11-04T01:01:33.396Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:01:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","reconcileID":"b4c2f2c8-22fd-453b-9693-35081dc9b2c2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:01:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:01:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:01:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:01:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:01:39Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T01:01:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:01:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","reconcileID":"84c47d7f-8a5d-44b2-9fdd-57354904164d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:01:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:01:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","reconcileID":"4dcbbb9c-3b52-4795-aacf-58fd6fe996cf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:01:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:01:44.698Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Limitador","ConfigMap","EnvoyFilter","AuthConfig"],"eventTypes":{"create":4,"delete":22,"update":4}}
{"level":"info","ts":"2026-11-04T01:01:44.993Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:46.960Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:01:47.152Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:01:47.152Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:01:51.061Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:01:51.065Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:51.072Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:01:51.072Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:01:51.072Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:01:51.075Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:01:51.315Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:02:02.872Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:02.872Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:02:03.487Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"external-model-e2e-dft-del-1f2cff-5b969f4819a5","namespace":"llm","error":"httproutes.gateway.networking.k8s.io \"external-model-e2e-dft-del-1f2cff-5b969f4819a5\" not found"}
{"level":"error","ts":"2026-11-04T01:02:04.172Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:02:04.704Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","HTTPRoute","Kuadrant","TokenRateLimitPolicy"],"eventTypes":{"create":4,"delete":1,"update":3}}
{"level":"info","ts":"2026-11-04T01:02:04.953Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:04.963Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:09.162Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:02:09.427Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:02:09.623Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:02:09.814Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:02:09.814Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:02:13.052Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:02:13.057Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:13.063Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:13.063Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:02:13.065Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:02:13.068Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:02:13.114Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-c18c7c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-extmod-a-c18c7c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-c18c7c","uid":"d99a03e5-588a-4606-a871-922cd8f3e865"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-c18c7c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-a-c18c7c\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:13.170Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-c18c7c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-extmod-a-c18c7c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-c18c7c","uid":"d99a03e5-588a-4606-a871-922cd8f3e865"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-c18c7c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-a-c18c7c\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:13.171Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:02:13.171Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:02:13.214Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"22923048ed576c224a64eaae2efed07d5626d93fefa3796f45283ecd9e38c1fa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["22923048ed576c224a64eaae2efed07d5626d93fefa3796f45283ecd9e38c1fa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"22923048ed576c224a64eaae2efed07d5626d93fefa3796f45283ecd9e38c1fa\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:13.280Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"}],"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","resourceVersion":"111724","uid":"4aeba8f0-1b34-4470-8415-8c1009b56810"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.349Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","resourceVersion":"111840","uid":"f8baf538-8b91-4b9d-93b4-3eb2ffb3dc44"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.447Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","resourceVersion":"111854","uid":"5d17b531-e50a-4506-bef1-8eaa2cb8960f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.513Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:05Z"}],"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system","resourceVersion":"111396","uid":"2bfa8997-be7f-413c-adee-59c5f62ebf9a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.579Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:11Z"}],"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","resourceVersion":"111785","uid":"4b310763-fcf4-40d4-b60d-82c26edb4d30"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.645Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"}],"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","resourceVersion":"111273","uid":"ce55126a-2797-4172-b44f-58d5fa61ef97"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.710Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-892a8f-29eeda5604fd","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-892a8f-29eeda5604fd#rule-1"},"creationTimestamp":"2026-11-04T01:00:08Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"33602ef9cfbf5688c71c3298c4b4d3515aebfa579fc31420efb58d0318bb31a7","namespace":"kuadrant-system","resourceVersion":"111619","uid":"33ca913f-3f44-46cf-a247-fc04af4989ce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["33602ef9cfbf5688c71c3298c4b4d3515aebfa579fc31420efb58d0318bb31a7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["33602ef9cfbf5688c71c3298c4b4d3515aebfa579fc31420efb58d0318bb31a7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"33602ef9cfbf5688c71c3298c4b4d3515aebfa579fc31420efb58d0318bb31a7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.859Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"}],"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","resourceVersion":"111578","uid":"a3cd9798-35c5-4e84-8035-49d9651e7466"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.883Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:04:16Z","generation":16,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"af1b8c6b-0ceb-4134-aa61-de1746b60d18\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:54Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"af1b8c6b-0ceb-4134-aa61-de1746b60d18"}],"resourceVersion":"113448","uid":"edcce1ea-eb55-46d5-a2c7-9f7dda82aae1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21ec9706b4a94388c311c23035210884c9182605d0f8e8c311ad2f41f60af9f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"64ebc053f7ddca8fcfda8c45de9c437281962e6adda72418849a0ab2e7d145c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-del-1f2cff')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-del-1f2cff/llm/e2e-dft-del-1f2cff-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"22923048ed576c224a64eaae2efed07d5626d93fefa3796f45283ecd9e38c1fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0ca9e40bb56a6c634f05edec24c89c6f1cd5deffd44cab02f5c380c6bbb555fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-del-1f2cff')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33602ef9cfbf5688c71c3298c4b4d3515aebfa579fc31420efb58d0318bb31a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2f4f31aa\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"077aa0bc809c4676\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-892a8f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2f4f31aa\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"077aa0bc809c4676\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-892a8f\"]}],\"name\":\"44fe9abee7cf8648fb25d1ca043e3d21a9bea8c6af604389966c34186ba0c8ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-892a8f')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-892a8f/llm/e2e-dft-892a8f-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a2573f75977e237be8837c17472a6e1f605a4fe91ca3eff85d99035c112e995\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__336eea21\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57d5334ceb6a8407\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-3099bf-13f3a22435a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-3099bf\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__336eea21\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57d5334ceb6a8407\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-3099bf-13f3a22435a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-3099bf\"]}],\"name\":\"58d8d8666b22f45284eb1381132231416a4b823f7ede8403d459c0bbcc519d9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-3099bf')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-3099bf/llm/e2e-dft-3099bf-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"412d1c0391928ff01a3a7ed7f70ab10779d5b8380e513bd9e8b0398a8611ab47\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2f4f31aa\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"077aa0bc809c4676\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-892a8f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2f4f31aa\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"077aa0bc809c4676\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-892a8f\"]}],\"name\":\"760bff2fc8ff1a814ad32d47e79e85db65bd92b7459ecd53cf056afb2552deb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-892a8f')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6dfe43b421fc9c5dd7fd8515b3d0226050a46aef05c7765ca1968216eb3e8a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__336eea21\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57d5334ceb6a8407\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-3099bf-13f3a22435a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-3099bf\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__336eea21\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57d5334ceb6a8407\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-3099bf-13f3a22435a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-3099bf\"]}],\"name\":\"c7a45dd83f90e55c93f6a3da741cffbb0815ee4995a2880fb21f445bc05cbfd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-3099bf')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6bd414c9c9359b65f02a8143d74549f89742cc5a5f2b1c5e5c4af3377d22138d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2f4f31aa\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"077aa0bc809c4676\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-892a8f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2f4f31aa\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"077aa0bc809c4676\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-892a8f\"]}],\"name\":\"107aec6ac184e792bc7986fc0b594cec21ba4b71e2c09b5039e77d4a9954f447\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-892a8f')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-892a8f/llm/e2e-dft-892a8f-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5527ef59ffe7c7aa0b889222ac38f891a67cc6be82b6601bcff972925491ad7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__336eea21\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57d5334ceb6a8407\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-3099bf-13f3a22435a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-3099bf\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__336eea21\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57d5334ceb6a8407\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-3099bf-13f3a22435a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-3099bf\"]}],\"name\":\"fa906d9f9af0937494d6239b1ef6fdb1d9c2b14af31e3499cd4d365df2e33dcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-3099bf')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-3099bf/llm/e2e-dft-3099bf-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ee3a2ffb8b300710d4d50333b7c4a4691e3a2e2afc7ce2e2564c018d86f879f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b7c16b431f04ffacbee325ba75a05a7820ba475160cde4cb809afcd7b66e3ffb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-del-1f2cff')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-del-1f2cff/llm/e2e-dft-del-1f2cff-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de279b2b92af88cacd6721681dbdce668019e822233ea14ae85de9993e23faac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2f4f31aa\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"077aa0bc809c4676\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-892a8f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2f4f31aa\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"077aa0bc809c4676\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-892a8f-29eeda5604fd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-892a8f\"]}],\"name\":\"f9173c1c3cc3a981be1581e7fbea556bfd5100457f95cac9b238701b78985633\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-892a8f')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"24eb75d55ca52fceb7e7bb6f7765e398b09c5a0e93669d990486fef52a245eb6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__336eea21\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57d5334ceb6a8407\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-3099bf-13f3a22435a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-3099bf\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__336eea21\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"57d5334ceb6a8407\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-3099bf-13f3a22435a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-dft-3099bf\"]}],\"name\":\"def7d36594c1dd77a35b258fc1575d1565a7780d192581f151430461ba1b1829\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-3099bf')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25c32744f61bd6cfdad5599874e7ab3b198d0d74b71b4110d88601b29e619d8f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"389d09a299bb80e221ae05dba5c236cdb26d39d1c2ce93da26bcafe68ce724d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-del-1f2cff')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.925Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"}],"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","resourceVersion":"111543","uid":"6a0aa075-2a97-4b6b-8291-ea7177f180e8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:13.991Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:05Z"}],"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","resourceVersion":"111435","uid":"3cadb7fb-34bb-4384-9baa-8b2e676dc6c0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.056Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-892a8f-29eeda5604fd","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-892a8f-29eeda5604fd#rule-3"},"creationTimestamp":"2026-11-04T01:00:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"}],"name":"412d1c0391928ff01a3a7ed7f70ab10779d5b8380e513bd9e8b0398a8611ab47","namespace":"kuadrant-system","resourceVersion":"111551","uid":"9256c25f-dfd0-4bdd-be19-2c48bb1628d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["412d1c0391928ff01a3a7ed7f70ab10779d5b8380e513bd9e8b0398a8611ab47"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["412d1c0391928ff01a3a7ed7f70ab10779d5b8380e513bd9e8b0398a8611ab47"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"412d1c0391928ff01a3a7ed7f70ab10779d5b8380e513bd9e8b0398a8611ab47\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.121Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"}],"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","resourceVersion":"111722","uid":"d7bcc5f6-9218-414f-b4a3-f8e8f42a7ea6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.188Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"}],"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","resourceVersion":"111528","uid":"46cd51d3-5f06-4d20-b71e-1f0b4db592de"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.253Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"}],"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","resourceVersion":"111769","uid":"b00ecfbf-ecc6-4817-b8c1-f0a5c174415a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.293Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-c18c7c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-extmod-a-c18c7c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-c18c7c","uid":"d99a03e5-588a-4606-a871-922cd8f3e865"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98753ab3d502f282509b6641477cd85e246f5270a9017703ff15087af1385084\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-c18c7c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]}],\"name\":\"f06f293d7bb9810e44f5ea8f8eafc82bbc4a6d2ff4bbccd398131fb3bb9b65fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3008a549a1f11eb28dba103a36e2dc30ca606a79dd7edfd737c43383d8f5e9d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-c18c7c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]}],\"name\":\"f7a7bf512b72be5060165a0893403caeb7e1058c93f07f9e2e072763bab41a82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e25807b82eae74ce7dd1b3c8dfaca85972f907346453e17834ba173de5b0433c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-c18c7c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]}],\"name\":\"933eaed4618f5d9dbd0853775ad1cc43c38f276ecaee1ddcea867d8fa020d9fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3e0593105546c83bf5a2b760d8d828002520d6ac21df86ab2feee5253632714b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-c18c7c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]}],\"name\":\"bce2063d1e0b9949d673c722eb6944bbfda685884e676b3b325560439c7b7e52\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1209850d5d9078dad25d4a320053d7dbd28ffc284e201aa002204c51b3c8094\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-c18c7c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]}],\"name\":\"dde7c6fe8ff70fb72bf66fd90526db761e5b6f3cfd0d0522194c175f47faf5b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa5ac5712a3fe38d1618e8aaf701ad80f5b1fcffbbc2b86bdbb08c041ecb0c90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-c18c7c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a029a640\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-c18c7c\"]}],\"name\":\"714ce0e7e238e479566d37aa19268440255733c1efbf1f341c7e1f57e8f3f8d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-c18c7c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-a-c18c7c\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:14.318Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"}],"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","resourceVersion":"111476","uid":"2e619d3e-8a68-4182-997f-3ea90cc450a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.383Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"}],"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","resourceVersion":"111512","uid":"6e833789-6bea-4b55-9954-107673397cb1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.449Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"}],"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","resourceVersion":"111299","uid":"81514f4e-cb8f-4022-b596-09cf37bd31d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.514Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:13Z"}],"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","resourceVersion":"111858","uid":"0790ee5c-e21f-4d7b-a394-c30498d06200"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.580Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:11Z"}],"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","resourceVersion":"111790","uid":"603b420f-4ff7-4b67-99f4-1e8d3f9cbcf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.646Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","resourceVersion":"111629","uid":"88066b40-e72f-45c3-9518-f4d65e7c02ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.713Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"}],"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","resourceVersion":"111255","uid":"8f728668-caee-43f7-9724-558cf8503a70"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.779Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"}],"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","resourceVersion":"111778","uid":"7290bf08-747f-4535-bdb4-b77f131ebf07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.846Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"}],"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","resourceVersion":"111573","uid":"5f83f408-3989-4587-955c-0d0e766e7b7c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.912Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"}],"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","resourceVersion":"111782","uid":"41c72840-cfaa-4309-bd59-f64cab0d82da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:14.978Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","resourceVersion":"111641","uid":"a2510f1b-a9b0-4a9c-bb15-c4621eb0422a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.043Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"}],"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system","resourceVersion":"111728","uid":"62c7cacb-180e-4c90-b5d6-1c407e60ad8d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.110Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"}],"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","resourceVersion":"111612","uid":"4b122b12-2473-4ae0-9741-fd52f84809db"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.175Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"}],"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","resourceVersion":"111682","uid":"b7d3a13b-e331-4e9f-a8d3-441262d963cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.241Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"}],"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","resourceVersion":"111776","uid":"5294372c-e0b1-4ea7-952e-b2054adcabed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.306Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system","resourceVersion":"111626","uid":"94e84cfc-05a1-4a7a-9c7c-93cb02e3fb46"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.372Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-3099bf-13f3a22435a8","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-3099bf-13f3a22435a8#rule-4"},"creationTimestamp":"2026-11-04T01:00:53Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:53Z"}],"name":"24eb75d55ca52fceb7e7bb6f7765e398b09c5a0e93669d990486fef52a245eb6","namespace":"kuadrant-system","resourceVersion":"113413","uid":"5d210903-8614-458c-801f-824355096cb8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["24eb75d55ca52fceb7e7bb6f7765e398b09c5a0e93669d990486fef52a245eb6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["24eb75d55ca52fceb7e7bb6f7765e398b09c5a0e93669d990486fef52a245eb6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"24eb75d55ca52fceb7e7bb6f7765e398b09c5a0e93669d990486fef52a245eb6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.438Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"}],"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","resourceVersion":"111609","uid":"7fb18842-43f0-4afd-8bd4-52524a4d528d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.503Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:13Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:13Z"}],"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","resourceVersion":"111865","uid":"bdcf0562-2434-42f0-af93-c1f674e609f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.569Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":"2026-11-04T00:04:15Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"}],"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system","resourceVersion":"111770","uid":"4b4b4404-04ab-47e7-9b6a-155abf48ee04"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.634Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"}],"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","resourceVersion":"111669","uid":"544dcd98-b37d-4269-af23-0d4485bbca38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.705Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"25c32744f61bd6cfdad5599874e7ab3b198d0d74b71b4110d88601b29e619d8f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["25c32744f61bd6cfdad5599874e7ab3b198d0d74b71b4110d88601b29e619d8f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"25c32744f61bd6cfdad5599874e7ab3b198d0d74b71b4110d88601b29e619d8f\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:15.771Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","resourceVersion":"111653","uid":"1a9f71de-b6a8-4351-92e5-78cbcf89ab07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.843Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fa5ac5712a3fe38d1618e8aaf701ad80f5b1fcffbbc2b86bdbb08c041ecb0c90","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fa5ac5712a3fe38d1618e8aaf701ad80f5b1fcffbbc2b86bdbb08c041ecb0c90"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fa5ac5712a3fe38d1618e8aaf701ad80f5b1fcffbbc2b86bdbb08c041ecb0c90\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:15.909Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"}],"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","resourceVersion":"111332","uid":"f4130945-c9d0-41b2-a0a6-41cb06e58f4e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:15.974Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"}],"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","resourceVersion":"111819","uid":"e3004949-e35c-4e9b-a643-a948028f20b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.038Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"}],"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","resourceVersion":"111520","uid":"225cedac-fad9-4cca-aea2-ff0dda2db89d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"}],"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","resourceVersion":"111814","uid":"0f705ecf-bf9f-42c5-923c-9bcdb55dd17c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.172Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:11Z"}],"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","resourceVersion":"111805","uid":"f0ec2b4b-b236-463a-b2a5-84c3f9b4ade2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.238Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"}],"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","resourceVersion":"111549","uid":"c0fe5844-d101-40b6-a43e-969837f9e0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.308Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3008a549a1f11eb28dba103a36e2dc30ca606a79dd7edfd737c43383d8f5e9d5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3008a549a1f11eb28dba103a36e2dc30ca606a79dd7edfd737c43383d8f5e9d5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3008a549a1f11eb28dba103a36e2dc30ca606a79dd7edfd737c43383d8f5e9d5\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:16.374Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:11Z"}],"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","resourceVersion":"111808","uid":"df6222c5-f966-4567-b1d3-714862434505"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.439Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"}],"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","resourceVersion":"111732","uid":"991fcc4c-9d1b-4b64-a94d-e09ed894da1f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.506Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"}],"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","resourceVersion":"111562","uid":"0c2279be-f80c-43ce-aa74-c6c4374682cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.572Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:13Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:13Z"}],"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","resourceVersion":"111872","uid":"0a533f9a-db7f-40ac-b074-215a942699d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.637Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:05Z"}],"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","resourceVersion":"111402","uid":"7dd02dee-21f8-4e8f-8bcf-34f7283568b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.708Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e25807b82eae74ce7dd1b3c8dfaca85972f907346453e17834ba173de5b0433c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e25807b82eae74ce7dd1b3c8dfaca85972f907346453e17834ba173de5b0433c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e25807b82eae74ce7dd1b3c8dfaca85972f907346453e17834ba173de5b0433c\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:16.773Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"}],"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","resourceVersion":"111684","uid":"82865439-7052-4692-af5e-0f30c505ccb7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.839Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:11Z"}],"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","resourceVersion":"111801","uid":"5aecf4b8-cefb-471c-94ac-d3451688a75b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.905Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"}],"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","resourceVersion":"111540","uid":"6327ba77-94b6-4bbb-bc8a-f883ff4a36e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:16.973Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:05Z"}],"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","resourceVersion":"111413","uid":"bed19aa4-37ac-48f3-890d-4584e37ea205"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.042Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"}],"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","resourceVersion":"111755","uid":"4789dc1d-0b51-4a6f-b176-5aee3fa5eb1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.113Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"}],"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","resourceVersion":"111773","uid":"5831c0c9-aa0b-49df-8c40-8305c69bb008"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.179Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"}],"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","resourceVersion":"111570","uid":"f659bddd-ccbc-4880-9d50-b3379269187a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.244Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"}],"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system","resourceVersion":"111685","uid":"a0647f68-e21f-4ae8-a007-876e4afcedc1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.311Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-3099bf-13f3a22435a8","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-3099bf-13f3a22435a8#rule-1"},"creationTimestamp":"2026-11-04T01:00:53Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:53Z"}],"name":"0a2573f75977e237be8837c17472a6e1f605a4fe91ca3eff85d99035c112e995","namespace":"kuadrant-system","resourceVersion":"113411","uid":"9607581b-1f0b-42ce-9e0a-0d224e638ddf"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0a2573f75977e237be8837c17472a6e1f605a4fe91ca3eff85d99035c112e995"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0a2573f75977e237be8837c17472a6e1f605a4fe91ca3eff85d99035c112e995"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0a2573f75977e237be8837c17472a6e1f605a4fe91ca3eff85d99035c112e995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.377Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system","resourceVersion":"111844","uid":"da925041-7e60-4173-a86b-d5b45301b805"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.443Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:13Z"}],"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","resourceVersion":"111862","uid":"b33246e7-0352-41d5-aeda-06370c4f2104"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.527Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"98753ab3d502f282509b6641477cd85e246f5270a9017703ff15087af1385084","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98753ab3d502f282509b6641477cd85e246f5270a9017703ff15087af1385084"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"98753ab3d502f282509b6641477cd85e246f5270a9017703ff15087af1385084\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:17.594Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:05Z"}],"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","resourceVersion":"111443","uid":"c1d0e4d7-4c7d-4727-a7b1-d4a8f60ffa63"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.660Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"}],"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","resourceVersion":"111582","uid":"5259cba1-fb24-4243-b768-481e6b8a2f74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.726Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"}],"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","resourceVersion":"111558","uid":"745d7dea-a67a-4a7b-907d-673608c2af48"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.791Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","resourceVersion":"111847","uid":"91fc9973-eae8-42fa-8bdc-767a7bbb76d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.862Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3e0593105546c83bf5a2b760d8d828002520d6ac21df86ab2feee5253632714b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3e0593105546c83bf5a2b760d8d828002520d6ac21df86ab2feee5253632714b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3e0593105546c83bf5a2b760d8d828002520d6ac21df86ab2feee5253632714b\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:17.927Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"}],"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","resourceVersion":"111772","uid":"1ed933c4-6946-4544-8f9c-f46f7e0d062a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:17.993Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:11Z"}],"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","resourceVersion":"111804","uid":"45307783-5fa5-44e4-9063-d54dd5c04711"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.058Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","resourceVersion":"111837","uid":"efe4bf6b-05b6-403d-802c-6d695d0e65d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.125Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"}],"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","resourceVersion":"111716","uid":"c7ad77a2-8814-49ae-98b8-eea0745f2dea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.191Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:06Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"}],"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","resourceVersion":"111309","uid":"11563e4d-bd42-439e-953f-44d0dd5d96c5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.257Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:11Z"}],"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","resourceVersion":"111787","uid":"436fe831-e0eb-4ef6-ba18-665342a6c7f4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"}],"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","resourceVersion":"111493","uid":"97d1e99e-db75-43ed-8e5c-d1ef7cbfcc8a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.389Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","resourceVersion":"111825","uid":"f4ad64b4-da27-4c73-bd47-df0058b599ab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","resourceVersion":"111636","uid":"e8d2a952-464c-46fe-a26d-8065101e10ba"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.519Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"}],"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","resourceVersion":"111292","uid":"28091510-d93c-4962-92f3-527e9404502d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.589Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"}],"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","resourceVersion":"111676","uid":"d7362fcf-6346-4177-8a82-a502664af493"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.656Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"}],"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","resourceVersion":"111710","uid":"28feee4f-561a-4d63-9877-c5bb7ff4d572"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.722Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","resourceVersion":"111856","uid":"eab2a7f4-0d1f-4109-b660-70398295531e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.787Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"}],"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","resourceVersion":"111590","uid":"ffdd41f3-82af-40be-bb9b-040eb397f7ce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.853Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","resourceVersion":"111646","uid":"8fea2396-6c61-4b0e-897e-a9ba0e797161"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.919Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","resourceVersion":"111650","uid":"4df3ee09-24f5-46d6-af83-5d91cc9b6a3f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:18.985Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"}],"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","resourceVersion":"111510","uid":"05c7120a-82ee-4fee-846a-4e3841beb2e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.050Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:07Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"}],"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","resourceVersion":"111525","uid":"aae853cf-0a4e-4aeb-a9d1-e210ae871fc6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.118Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"}],"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","resourceVersion":"111760","uid":"c6683eb7-c87e-4ca2-82c1-0a26a13c0533"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.190Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7ee3a2ffb8b300710d4d50333b7c4a4691e3a2e2afc7ce2e2564c018d86f879f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7ee3a2ffb8b300710d4d50333b7c4a4691e3a2e2afc7ce2e2564c018d86f879f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7ee3a2ffb8b300710d4d50333b7c4a4691e3a2e2afc7ce2e2564c018d86f879f\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:19.256Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-3099bf-13f3a22435a8","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-3099bf-13f3a22435a8#rule-3"},"creationTimestamp":"2026-11-04T01:00:53Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:53Z"}],"name":"f6dfe43b421fc9c5dd7fd8515b3d0226050a46aef05c7765ca1968216eb3e8a0","namespace":"kuadrant-system","resourceVersion":"113429","uid":"83a0f89e-aee5-43b5-919c-c03f31d4c130"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6dfe43b421fc9c5dd7fd8515b3d0226050a46aef05c7765ca1968216eb3e8a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6dfe43b421fc9c5dd7fd8515b3d0226050a46aef05c7765ca1968216eb3e8a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6dfe43b421fc9c5dd7fd8515b3d0226050a46aef05c7765ca1968216eb3e8a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.322Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","resourceVersion":"111616","uid":"591b2c08-f8dd-44ee-85ae-148c50d87e9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.388Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-892a8f-29eeda5604fd","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-892a8f-29eeda5604fd#rule-4"},"creationTimestamp":"2026-11-04T01:00:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"}],"name":"de279b2b92af88cacd6721681dbdce668019e822233ea14ae85de9993e23faac","namespace":"kuadrant-system","resourceVersion":"111689","uid":"15fa0778-3a47-40b8-8ba6-f8274dd056b3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de279b2b92af88cacd6721681dbdce668019e822233ea14ae85de9993e23faac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de279b2b92af88cacd6721681dbdce668019e822233ea14ae85de9993e23faac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de279b2b92af88cacd6721681dbdce668019e822233ea14ae85de9993e23faac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.453Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"}],"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","resourceVersion":"111497","uid":"b1c16000-3633-41db-a343-82b238efb39f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.520Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"}],"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","resourceVersion":"111706","uid":"a734419e-fb72-4d8c-8726-0cf49c79903b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:29:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:29:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.591Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"}],"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","resourceVersion":"111596","uid":"2e63465b-6b28-4996-9d9f-439009fe7879"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.657Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"}],"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","resourceVersion":"111264","uid":"29639e67-1f6c-4127-bcb9-cce9ff973a39"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.730Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-del-1f2cff-5b969f4819a5#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"21ec9706b4a94388c311c23035210884c9182605d0f8e8c311ad2f41f60af9f6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["21ec9706b4a94388c311c23035210884c9182605d0f8e8c311ad2f41f60af9f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"21ec9706b4a94388c311c23035210884c9182605d0f8e8c311ad2f41f60af9f6\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:19.798Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"}],"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","resourceVersion":"111702","uid":"ea93d085-96bb-46ba-9258-16618433a0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.887Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"}],"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","resourceVersion":"111320","uid":"a3a8f190-0b70-4fce-975e-ca63be466540"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:19.977Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"}],"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","resourceVersion":"111325","uid":"03510a5d-12ad-47ac-8aa3-861a3474a6ef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.046Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"}],"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","resourceVersion":"111585","uid":"9ab9be04-60a7-4454-ba4d-ca03f4b8f174"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.125Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:13Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:13Z"}],"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","resourceVersion":"111869","uid":"f5aa5634-1eef-4c83-9de8-beb2bea42b54"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.194Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:07Z"}],"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","resourceVersion":"111534","uid":"0d8715b8-d57a-454f-a76b-daeba49ae132"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.262Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:08Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","resourceVersion":"111851","uid":"8d56271a-0715-4609-9700-c88e7b27e0fe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.335Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-c18c7c#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c1209850d5d9078dad25d4a320053d7dbd28ffc284e201aa002204c51b3c8094","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c1209850d5d9078dad25d4a320053d7dbd28ffc284e201aa002204c51b3c8094"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-c18c7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c1209850d5d9078dad25d4a320053d7dbd28ffc284e201aa002204c51b3c8094\" already exists"}
{"level":"error","ts":"2026-11-04T01:02:20.402Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-3099bf-13f3a22435a8","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-3099bf-13f3a22435a8#rule-2"},"creationTimestamp":"2026-11-04T01:00:53Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:53Z"}],"name":"f5527ef59ffe7c7aa0b889222ac38f891a67cc6be82b6601bcff972925491ad7","namespace":"kuadrant-system","resourceVersion":"113416","uid":"65cb971c-321e-4048-8567-179b59d3b4ef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f5527ef59ffe7c7aa0b889222ac38f891a67cc6be82b6601bcff972925491ad7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f5527ef59ffe7c7aa0b889222ac38f891a67cc6be82b6601bcff972925491ad7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f5527ef59ffe7c7aa0b889222ac38f891a67cc6be82b6601bcff972925491ad7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.467Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:06Z"}],"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","resourceVersion":"111504","uid":"f67432a6-d4fc-4453-9f0c-4f3e66d88a3d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.537Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"}],"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","resourceVersion":"111659","uid":"7ee97d41-8f87-4354-84af-b7e57b6b4bd3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.605Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:16Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:05Z"}],"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","resourceVersion":"111420","uid":"68046133-2e5e-4698-9fff-9ef40e5ac5d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.671Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","resourceVersion":"111822","uid":"c8f8cd08-2a0f-4e20-a30b-5e6ca75dc31e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.738Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:10Z"}],"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","resourceVersion":"111730","uid":"5c3c058c-07cf-4597-81f0-f0a0e6273d1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.804Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-892a8f-29eeda5604fd","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-892a8f-29eeda5604fd#rule-2"},"creationTimestamp":"2026-11-04T01:00:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:09Z"}],"name":"6bd414c9c9359b65f02a8143d74549f89742cc5a5f2b1c5e5c4af3377d22138d","namespace":"kuadrant-system","resourceVersion":"111679","uid":"7399d5c8-5c0e-4e81-8e4f-a076fb17a538"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6bd414c9c9359b65f02a8143d74549f89742cc5a5f2b1c5e5c4af3377d22138d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6bd414c9c9359b65f02a8143d74549f89742cc5a5f2b1c5e5c4af3377d22138d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6bd414c9c9359b65f02a8143d74549f89742cc5a5f2b1c5e5c4af3377d22138d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.870Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:13Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:13Z"}],"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","resourceVersion":"111890","uid":"5199cd06-551e-406b-bee6-d4d24c5d5c84"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:20.938Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:35Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"}],"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","resourceVersion":"111306","uid":"4cb69f08-179a-469d-b779-b7042c6da4e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:21.005Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:09Z"}],"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","resourceVersion":"111671","uid":"680a2fbe-042b-4b0d-967b-f9c50d18d20c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:21.073Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:08Z"}],"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","resourceVersion":"111604","uid":"9d1c31ae-1c67-4bcf-92ea-4206077e7438"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:21.145Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:12Z"}],"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","resourceVersion":"111832","uid":"749db18a-efd0-45ab-9944-de1d056f97d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:21.212Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:06Z"}],"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","resourceVersion":"111488","uid":"f0b58eae-b5a7-4dc6-88bf-c1cb6e8b2bb6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:21.281Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:05Z"}],"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","resourceVersion":"111451","uid":"2ebc719a-5efd-4f44-8a8b-a20427dd08a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:21.347Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:00:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:00:05Z"}],"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","resourceVersion":"111387","uid":"4789cda5-d34c-48f9-9bdd-b029016fb3a4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\") || name in [\"x-grid-geo-fencing\"])"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-grid-geo-fencing":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && \"headers\" in auth.metadata[\"subscription-info\"] && \"x-grid-geo-fencing\" in auth.metadata[\"subscription-info\"].headers ? auth.metadata[\"subscription-info\"].headers[\"x-grid-geo-fencing\"].join(\", \") : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:21.659Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-dft-892a8f","namespace":"llm","uid":"f83f96e7-a782-496b-86c8-dff5546b4d43","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-dft-892a8f\" not found"}
{"level":"error","ts":"2026-11-04T01:02:21.823Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:22.107Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-dft-3099bf","namespace":"llm","uid":"864cf8bb-5682-4484-9b8d-8b65bede1f0e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-dft-3099bf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:22.294Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-c18c7c","namespace":"openshift-ingress","uid":"bfc2f217-f22c-4788-99d7-6553041b36c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-c18c7c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:22.536Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-c18c7c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-extmod-a-c18c7c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:02:23.187Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:23.187Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:02:23.355Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"external-model-e2e-dft-892a8f-29eeda5604fd","namespace":"llm","error":"httproutes.gateway.networking.k8s.io \"external-model-e2e-dft-892a8f-29eeda5604fd\" not found"}
{"level":"error","ts":"2026-11-04T01:02:23.433Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"external-model-e2e-dft-del-1f2cff-5b969f4819a5","namespace":"llm","error":"httproutes.gateway.networking.k8s.io \"external-model-e2e-dft-del-1f2cff-5b969f4819a5\" not found"}
{"level":"error","ts":"2026-11-04T01:02:23.819Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:23.885Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-extmod-a-c18c7c","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-extmod-a-c18c7c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:23.950Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"external-model-e2e-dft-3099bf-13f3a22435a8","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"external-model-e2e-dft-3099bf-13f3a22435a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:02:24.345Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-c18c7c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-c18c7c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:02:31.820Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","EnvoyFilter","HTTPRoute","TokenRateLimitPolicy","Gateway","Limitador","ConfigMap"],"eventTypes":{"create":15,"delete":3,"update":121}}
{"level":"info","ts":"2026-11-04T01:02:32.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:34.462Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:02:34.637Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:02:34.637Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:02:39.340Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:02:39.362Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:39.369Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:02:39.434Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:02:39.443Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:39.443Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:02:39.528Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:02:40Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","reconcileID":"ea8b7051-9759-4939-9943-701febd4a516","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:02:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:02:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","reconcileID":"3326b32c-75d5-432d-bc0b-817e9ef2f4d0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","reconcileID":"7beee0a1-c71b-4360-b829-3a411b5bd48a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:02:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:02:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:02:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:02:42Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:02:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:02:43.151Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:43.151Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:02:43.711Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-9298a8","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-9298a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:02:51.810Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","HTTPRoute","Limitador","TokenRateLimitPolicy","ConfigMap","Kuadrant","Gateway","EnvoyFilter","AuthConfig"],"eventTypes":{"create":3,"delete":8,"update":8}}
{"level":"info","ts":"2026-11-04T01:02:52.218Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:52.238Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:55.356Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:02:55.431Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:02:55.645Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:02:55.646Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:02:55.646Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:02:59.056Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:02:59.058Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:59.122Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:02:59.130Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:02:59.137Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:02:59.137Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:02:59.231Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:02:59.231Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:03:02.613Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:02.613Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:03:12.822Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","Gateway","HTTPRoute","Limitador","EnvoyFilter","AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"create":10,"update":6}}
{"level":"info","ts":"2026-11-04T01:03:13.254Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:16.447Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:03:16.614Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:03:16.614Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:03:18Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","reconcileID":"33977468-21bc-45f0-a1ee-d903da2f0dfd","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:03:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:03:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:03:19Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:03:19Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:03:20Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T01:03:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:03:20Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","reconcileID":"131fd878-2ba7-4dfb-89ae-6ef78cad545f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:03:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:03:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:03:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:03:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:03:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:03:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","reconcileID":"6d4fc13e-990d-4683-86b8-af80be2b8b8d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:03:21.559Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:21.572Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:03:21.615Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:03:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:03:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:03:21.559Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:03:21.658Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:21.658Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:03:21.734Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:03:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:03:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:03:22Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:03:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:03:25.068Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:25.068Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:03:26.068Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-61d74f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-61d74f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:03:33.754Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","Limitador","AuthPolicy","ConfigMap","HTTPRoute","Kuadrant"],"eventTypes":{"create":3,"update":6}}
{"level":"info","ts":"2026-11-04T01:03:34.154Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:34.162Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:37.124Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:03:37.151Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:03:37.251Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:03:37.420Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:03:37.420Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:03:41.225Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:03:41.233Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:41.239Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:03:41.243Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:03:41.246Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:41.246Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:03:41.393Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:03:41.393Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:03:44.806Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:03:44.806Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:03:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","reconcileID":"a91bec40-56dc-4350-b51f-bc558826132d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:03:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:03:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","reconcileID":"fc5c895f-0fe7-483e-a9f9-b3d0a4f5885e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:03:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","reconcileID":"ac3efce4-e9ae-43c3-8cbc-4cd9c525ccca","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:03:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:03:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:03:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:03:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:03:52Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:03:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:03:57.334Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","TokenRateLimitPolicy","EnvoyFilter","ConfigMap","HTTPRoute","Gateway","Limitador"],"eventTypes":{"create":9,"update":6}}
{"level":"info","ts":"2026-11-04T01:03:57.737Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:00.157Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:04:00.348Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:04:00.348Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:04.053Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:04:04.047Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:04:04.054Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:04.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:04:04.157Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:04.157Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:04.277Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:07.924Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:07.924Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:09.851Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","TokenRateLimitPolicy","AuthPolicy","HTTPRoute"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-04T01:04:10.150Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:10.158Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:14.454Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:14.753Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:04:14.944Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:04:14.944Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:14.964Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:04:19.091Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:19.083Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:04:19.114Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:04:19.122Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:04:19.123Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:19.123Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:04:19.144Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-b5c4bc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-inf-a-b5c4bc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-b5c4bc","uid":"4541c398-bf49-418c-ab3c-ea99f138ca0a"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-b5c4bc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-a-b5c4bc\" already exists"}
{"level":"error","ts":"2026-11-04T01:04:19.145Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-b5c4bc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-inf-a-b5c4bc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-b5c4bc","uid":"4541c398-bf49-418c-ab3c-ea99f138ca0a"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-b5c4bc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-a-b5c4bc\" already exists"}
{"level":"error","ts":"2026-11-04T01:04:19.209Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:04:19.209Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:04:19.218Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4ff8ad83cfc1b2bb9700bf26b69dd9246344c90dfad14373c2a24a94823d1d99","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4ff8ad83cfc1b2bb9700bf26b69dd9246344c90dfad14373c2a24a94823d1d99"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4ff8ad83cfc1b2bb9700bf26b69dd9246344c90dfad14373c2a24a94823d1d99\" already exists"}
{"level":"error","ts":"2026-11-04T01:04:19.340Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"881e323a1b5ba450c111b3ecf2e8e4b4631e4c5010cd9b41f7162abbe8314b07","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["881e323a1b5ba450c111b3ecf2e8e4b4631e4c5010cd9b41f7162abbe8314b07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"881e323a1b5ba450c111b3ecf2e8e4b4631e4c5010cd9b41f7162abbe8314b07\" already exists"}
{"level":"error","ts":"2026-11-04T01:04:19.438Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6eb41a3076c4c0a6b52c5edcd2c9f0547731ffd8633d3b741d07877354ee7f69","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6eb41a3076c4c0a6b52c5edcd2c9f0547731ffd8633d3b741d07877354ee7f69"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6eb41a3076c4c0a6b52c5edcd2c9f0547731ffd8633d3b741d07877354ee7f69\" already exists"}
{"level":"error","ts":"2026-11-04T01:04:19.531Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e1192709d9fcf6e965fc9fc07443e1414aa2ab670a15dea6f53167b3c09a3998","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e1192709d9fcf6e965fc9fc07443e1414aa2ab670a15dea6f53167b3c09a3998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e1192709d9fcf6e965fc9fc07443e1414aa2ab670a15dea6f53167b3c09a3998\" already exists"}
{"level":"error","ts":"2026-11-04T01:04:19.651Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c1f1791f86ec1f2a4dcdc29ce424897741eef1a7990653966e300b98cb97dd85","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c1f1791f86ec1f2a4dcdc29ce424897741eef1a7990653966e300b98cb97dd85"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c1f1791f86ec1f2a4dcdc29ce424897741eef1a7990653966e300b98cb97dd85\" already exists"}
{"level":"error","ts":"2026-11-04T01:04:19.801Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6bb751712c9ad90e7f088c66ac404aa9f65e249afe80cd456aac1db0b0dc9331","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6bb751712c9ad90e7f088c66ac404aa9f65e249afe80cd456aac1db0b0dc9331"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-b5c4bc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6bb751712c9ad90e7f088c66ac404aa9f65e249afe80cd456aac1db0b0dc9331\" already exists"}
{"level":"error","ts":"2026-11-04T01:04:20.022Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-b5c4bc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-inf-a-b5c4bc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-b5c4bc","uid":"4541c398-bf49-418c-ab3c-ea99f138ca0a"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ff8ad83cfc1b2bb9700bf26b69dd9246344c90dfad14373c2a24a94823d1d99\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"3c790f15f606e045e9147f1a562f8ec3f903c7d09c7fb67300ca942a9a85a9ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"881e323a1b5ba450c111b3ecf2e8e4b4631e4c5010cd9b41f7162abbe8314b07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"cf1370d11c52e11a47ebd9b0212a2266556b11e4ad665c1488daa30401c002fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6bb751712c9ad90e7f088c66ac404aa9f65e249afe80cd456aac1db0b0dc9331\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"19d819a7d39d808f9ff3490223bc0e7968ee9c894b2668c0ec87bb75b41a928a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6eb41a3076c4c0a6b52c5edcd2c9f0547731ffd8633d3b741d07877354ee7f69\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"f6dcfdbd3fb2835092523a5a19864258b6c5fafc470a872ac944ccaf6806adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1192709d9fcf6e965fc9fc07443e1414aa2ab670a15dea6f53167b3c09a3998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"708825876b3fe2048de77c9ce82d768acee5825e73d19136020108da7e0c5b82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1f1791f86ec1f2a4dcdc29ce424897741eef1a7990653966e300b98cb97dd85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"eef46ed61aaff20c32d6b5b8bac107f7c99fdc3f12dfcc58359c93575304d2c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-b5c4bc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-b5c4bc\" already exists"}
{"level":"error","ts":"2026-11-04T01:04:21.324Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-b5c4bc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-b5c4bc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:04:21.398Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-61d74f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-61d74f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:04:22.394Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-b5c4bc","namespace":"openshift-ingress","uid":"58a38c58-6d15-449a-b06e-3b2e1c685e41","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-b5c4bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:04:22.641Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-61d74f","namespace":"openshift-ingress","uid":"53b38ed7-f6d1-4e35-af9c-a99268f2a4b5","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-61d74f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:04:23.202Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:23.202Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:04:23.268Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-inf-a-b5c4bc","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-inf-a-b5c4bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:04:24.560Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-b5c4bc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-b5c4bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:04:32.058Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","AuthConfig","Gateway","AuthPolicy","ConfigMap","Limitador","HTTPRoute"],"eventTypes":{"create":10,"update":8}}
{"level":"info","ts":"2026-11-04T01:04:32.302Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:34.756Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:04:34.845Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:04:34.845Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","reconcileID":"f01d7689-52e2-4fa9-8779-defa72b9d958","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:04:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:04:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:04:38.803Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:04:38.819Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:38.820Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:04:38.823Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:38.823Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:38.826Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:04:38.826Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:04:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:04:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:04:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","reconcileID":"55da63cc-f434-4e1f-8240-2be199cc40c8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:04:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:04:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:04:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:04:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:04:39Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:04:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:04:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","reconcileID":"652f558c-6e40-443e-a868-dc940f29ef4e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:04:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:04:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:04:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:04:40Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:04:40Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:04:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:04:42.550Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:42.550Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:04:43.593Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-2f5c48","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-2f5c48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:04:51.792Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","AuthPolicy","ConfigMap","HTTPRoute","Kuadrant"],"eventTypes":{"create":3,"update":29}}
{"level":"info","ts":"2026-11-04T01:04:52.097Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:52.118Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:04:55.844Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:04:56.736Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:04:56.836Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:04:57.014Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:04:57.014Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:01.539Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:05:01.542Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:01.560Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:05:01.571Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:05:01.602Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:01.602Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:01.695Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:05.753Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:05.753Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:14.571Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","AuthConfig","AuthPolicy","EnvoyFilter","HTTPRoute","Gateway","ConfigMap"],"eventTypes":{"create":10,"update":31}}
{"level":"info","ts":"2026-11-04T01:05:14.889Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:17.540Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:05:17.742Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:05:17.742Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:21.720Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:05:21.720Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:21.727Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:05:21.727Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:21.748Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:21.748Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:21.750Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:05:25.460Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:25.460Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:34.675Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"create":1,"update":29}}
{"level":"info","ts":"2026-11-04T01:05:34.973Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:37.147Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:05:37.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:05:37.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:41.582Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:05:41.613Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:41.613Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:05:41.620Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:05:41.620Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:41.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:41.622Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:45.507Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:45.507Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:48Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","reconcileID":"1b94e527-66cc-4e42-b1d0-d3d9ffbaaa17","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:05:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:05:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","reconcileID":"540d74a3-8070-4127-a393-6be8485973dc","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","reconcileID":"03861fae-fc63-40c9-8d8c-1dfe1a37cd4e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:05:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:05:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:05:50Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:05:50Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:05:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:05:55.773Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Kuadrant","ConfigMap","AuthPolicy","TokenRateLimitPolicy","Gateway"],"eventTypes":{"create":3,"update":3}}
{"level":"info","ts":"2026-11-04T01:05:56.287Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:56.307Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:05:59.253Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:05:59.424Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:05:59.424Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:05:59.861Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:06:00.147Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:04.137Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:06:04.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:04.155Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:06:04.161Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:06:04.164Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:04.164Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:04.315Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:08.284Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:08.284Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:19.678Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","AuthConfig","ConfigMap","Limitador","Gateway","AuthPolicy","HTTPRoute"],"eventTypes":{"create":9,"update":32}}
{"level":"info","ts":"2026-11-04T01:06:20.174Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:23.935Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:06:24.149Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:06:24.149Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:28.857Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:06:28.874Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:28.874Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:28.874Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:28.875Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:06:28.946Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:06:28.946Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:33.050Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:33.050Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:06:33.539Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-cb2be0","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-cb2be0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:06:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cb2be0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cb2be0","reconcileID":"33d34f6e-81e4-4c1b-b683-42126f792049","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-cb2be0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:06:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cb2be0","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:06:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:06:35Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:06:35Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:06:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:06:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cb2be0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cb2be0","reconcileID":"e45c62d9-5fa7-421e-937f-bd012d67f6c3","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-cb2be0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:06:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cb2be0","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:06:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:06:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:06:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:06:36Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:06:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:06:42.189Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","TokenRateLimitPolicy","Gateway","HTTPRoute","Limitador","AuthPolicy","ConfigMap"],"eventTypes":{"create":3,"update":32}}
{"level":"info","ts":"2026-11-04T01:06:42.667Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:42.686Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:46.444Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:46.659Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:06:46.826Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:06:46.826Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:46.826Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:06:50.844Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:06:50.853Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:50.861Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:06:50.861Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:06:50.863Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:50.863Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:51.079Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:06:55.156Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:06:55.156Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:07:04.768Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","Limitador","ConfigMap","EnvoyFilter","Gateway","HTTPRoute","AuthPolicy"],"eventTypes":{"create":9,"update":33}}
{"level":"info","ts":"2026-11-04T01:07:05.231Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:09.322Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:07:09.434Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:07:09.434Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:07:11Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","reconcileID":"3b081987-2cde-47ae-9002-ba223aeca1e7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:07:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:07:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","reconcileID":"aab842b1-e4da-43a2-883e-5cf7877a2d43","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:07:13.193Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:07:13.215Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:13.216Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:07:13.223Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:07:13.223Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:07:13.234Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:13.234Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","reconcileID":"214d41f6-9a7e-440f-84a9-bb605ad47c83","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:07:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:07:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:07:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:07:14Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:07:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:07:17.327Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:17.327Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:07:18.492Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-80f48d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-80f48d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:07:26.727Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","Gateway","AuthPolicy","HTTPRoute","Kuadrant","ConfigMap"],"eventTypes":{"create":3,"update":33}}
{"level":"info","ts":"2026-11-04T01:07:26.984Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:26.991Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:30.952Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:07:31.197Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:07:31.197Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","reconcileID":"b1c7c35d-3a72-4382-b854-325c99630975","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:07:31.613Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","reconcileID":"b1c7c35d-3a72-4382-b854-325c99630975","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-c18c7c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-c18c7c","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-c18c7c\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:07:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:07:31.858Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:07:36.172Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:36.214Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:07:36.161Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:07:36.220Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:36.220Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:07:36.223Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:07:36.388Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:07:39.322Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-dft-3099bf","namespace":"llm","uid":"864cf8bb-5682-4484-9b8d-8b65bede1f0e","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-dft-3099bf\" not found"}
{"level":"error","ts":"2026-11-04T01:07:39.500Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-c18c7c-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-a-c18c7c-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:07:40.401Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:07:40.556Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-c18c7c","namespace":"openshift-ingress","uid":"bfc2f217-f22c-4788-99d7-6553041b36c7","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-c18c7c\" not found"}
{"level":"info","ts":"2026-11-04T01:07:40.840Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:40.840Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:07:41.177Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:07:41.563Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-c18c7c","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-a-c18c7c\" not found"}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","reconcileID":"b1a06295-dd1a-48e1-8654-b0d8958e7ade","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","reconcileID":"b1a06295-dd1a-48e1-8654-b0d8958e7ade","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-2f5c48","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-2f5c48","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-b-2f5c48\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:07:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:07:55.326Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","AuthConfig","Limitador","Kuadrant","AuthPolicy","ConfigMap","EnvoyFilter","HTTPRoute"],"eventTypes":{"create":10,"delete":9,"update":35}}
{"level":"info","ts":"2026-11-04T01:07:55.796Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:55.804Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:07:59.461Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:07:59.626Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:07:59.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:07:59.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:07:59.751Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:08:04.309Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:08:04.309Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:04.322Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:08:04.326Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:08:04.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:04.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:08:04.420Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-extmod-b-2f5c48","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-b-2f5c48\" not found"}
{"level":"error","ts":"2026-11-04T01:08:04.420Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-extmod-b-2f5c48","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-b-2f5c48\" not found"}
{"level":"error","ts":"2026-11-04T01:08:04.425Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:08:04.425Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:08:05.743Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-extmod-b-2f5c48","envoyfilter":"openshift-ingress/kuadrant-e2e-extmod-b-2f5c48","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-b-2f5c48\" not found"}
{"level":"error","ts":"2026-11-04T01:08:15.559Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-b-2f5c48-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-b-2f5c48-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T01:08:15.952Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:15.952Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:08:16.144Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-2f5c48","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-b-2f5c48\" not found"}
{"level":"error","ts":"2026-11-04T01:08:16.633Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:08:18.068Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":2}}
{"level":"info","ts":"2026-11-04T01:08:18.316Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:18.323Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:22.225Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:08:22.441Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:08:22.657Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:08:22.658Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:08:22.658Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:08:26.663Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:08:26.713Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:08:26.715Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:26.723Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:08:26.728Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:26.728Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:08:26.830Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system","resourceVersion":"115460","uid":"62c7cacb-180e-4c90-b5d6-1c407e60ad8d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:26.874Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-extmod-b-2f5c48","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-b-2f5c48\" not found"}
{"level":"error","ts":"2026-11-04T01:08:26.874Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-extmod-b-2f5c48","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-b-2f5c48\" not found"}
{"level":"error","ts":"2026-11-04T01:08:26.878Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:08:26.878Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:08:26.896Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:51Z"}],"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","resourceVersion":"114990","uid":"ce55126a-2797-4172-b44f-58d5fa61ef97"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:26.962Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:57Z"}],"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","resourceVersion":"115316","uid":"c7ad77a2-8814-49ae-98b8-eea0745f2dea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.028Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","resourceVersion":"115475","uid":"6327ba77-94b6-4bbb-bc8a-f883ff4a36e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.094Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:57Z"}],"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","resourceVersion":"115308","uid":"5831c0c9-aa0b-49df-8c40-8305c69bb008"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.160Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","resourceVersion":"115246","uid":"0c2279be-f80c-43ce-aa74-c6c4374682cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:57Z"}],"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","resourceVersion":"115288","uid":"0790ee5c-e21f-4d7b-a394-c30498d06200"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.293Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","resourceVersion":"115451","uid":"eab2a7f4-0d1f-4109-b660-70398295531e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.358Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:51Z"}],"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","resourceVersion":"115005","uid":"f0ec2b4b-b236-463a-b2a5-84c3f9b4ade2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.424Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"}],"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","resourceVersion":"115037","uid":"b1c16000-3633-41db-a343-82b238efb39f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.491Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","resourceVersion":"115500","uid":"d7bcc5f6-9218-414f-b4a3-f8e8f42a7ea6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.561Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"}],"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","resourceVersion":"115010","uid":"41c72840-cfaa-4309-bd59-f64cab0d82da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.631Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","resourceVersion":"115420","uid":"88066b40-e72f-45c3-9518-f4d65e7c02ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.728Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"}],"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","resourceVersion":"115047","uid":"5294372c-e0b1-4ea7-952e-b2054adcabed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.795Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","resourceVersion":"115462","uid":"749db18a-efd0-45ab-9944-de1d056f97d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.901Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system","resourceVersion":"115232","uid":"94e84cfc-05a1-4a7a-9c7c-93cb02e3fb46"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.965Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:04:16Z","generation":18,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"af1b8c6b-0ceb-4134-aa61-de1746b60d18\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:40Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"af1b8c6b-0ceb-4134-aa61-de1746b60d18"}],"resourceVersion":"116985","uid":"edcce1ea-eb55-46d5-a2c7-9f7dda82aae1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:27.967Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","resourceVersion":"115443","uid":"f5aa5634-1eef-4c83-9de8-beb2bea42b54"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.033Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","resourceVersion":"115381","uid":"f4ad64b4-da27-4c73-bd47-df0058b599ab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.099Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:58Z"}],"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system","resourceVersion":"115344","uid":"2bfa8997-be7f-413c-adee-59c5f62ebf9a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.166Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:55Z"}],"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","resourceVersion":"115202","uid":"46cd51d3-5f06-4d20-b71e-1f0b4db592de"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.232Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:54Z"}],"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","resourceVersion":"115158","uid":"ffdd41f3-82af-40be-bb9b-040eb397f7ce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.298Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","resourceVersion":"115375","uid":"f8baf538-8b91-4b9d-93b4-3eb2ffb3dc44"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.363Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","resourceVersion":"115502","uid":"9d1c31ae-1c67-4bcf-92ea-4206077e7438"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.429Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","resourceVersion":"115395","uid":"28091510-d93c-4962-92f3-527e9404502d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.494Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","resourceVersion":"115489","uid":"0f705ecf-bf9f-42c5-923c-9bcdb55dd17c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.560Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:53Z"}],"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","resourceVersion":"115093","uid":"2e63465b-6b28-4996-9d9f-439009fe7879"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.625Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","resourceVersion":"115218","uid":"2e619d3e-8a68-4182-997f-3ea90cc450a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.691Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"}],"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","resourceVersion":"115026","uid":"a3cd9798-35c5-4e84-8035-49d9651e7466"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.704Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-extmod-b-2f5c48","envoyfilter":"openshift-ingress/kuadrant-e2e-extmod-b-2f5c48","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-b-2f5c48\" not found"}
{"level":"error","ts":"2026-11-04T01:08:28.756Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:06Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"}],"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","resourceVersion":"115014","uid":"11563e4d-bd42-439e-953f-44d0dd5d96c5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.821Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","resourceVersion":"115492","uid":"81514f4e-cb8f-4022-b596-09cf37bd31d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.887Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","resourceVersion":"115402","uid":"5f83f408-3989-4587-955c-0d0e766e7b7c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:28.953Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:57Z"}],"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system","resourceVersion":"115304","uid":"a0647f68-e21f-4ae8-a007-876e4afcedc1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.019Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:51Z"}],"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","resourceVersion":"114986","uid":"b33246e7-0352-41d5-aeda-06370c4f2104"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.085Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"}],"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","resourceVersion":"115040","uid":"bed19aa4-37ac-48f3-890d-4584e37ea205"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.152Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:55Z"}],"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","resourceVersion":"115205","uid":"29639e67-1f6c-4127-bcb9-cce9ff973a39"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.218Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:53Z"}],"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","resourceVersion":"115091","uid":"f67432a6-d4fc-4453-9f0c-4f3e66d88a3d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.284Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","resourceVersion":"115222","uid":"680a2fbe-042b-4b0d-967b-f9c50d18d20c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.350Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","resourceVersion":"115229","uid":"4df3ee09-24f5-46d6-af83-5d91cc9b6a3f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.417Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:58Z"}],"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","resourceVersion":"115348","uid":"f659bddd-ccbc-4880-9d50-b3379269187a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.484Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","resourceVersion":"115243","uid":"c6683eb7-c87e-4ca2-82c1-0a26a13c0533"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.550Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system","resourceVersion":"115431","uid":"da925041-7e60-4173-a86b-d5b45301b805"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:02:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:02:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.615Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:57Z"}],"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","resourceVersion":"115318","uid":"a734419e-fb72-4d8c-8726-0cf49c79903b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:29:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:29:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.681Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"}],"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","resourceVersion":"115085","uid":"6e833789-6bea-4b55-9954-107673397cb1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.746Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","resourceVersion":"115427","uid":"0a533f9a-db7f-40ac-b074-215a942699d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.812Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:58Z"}],"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","resourceVersion":"115373","uid":"c1d0e4d7-4c7d-4727-a7b1-d4a8f60ffa63"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.879Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:54Z"}],"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","resourceVersion":"115142","uid":"28feee4f-561a-4d63-9877-c5bb7ff4d572"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:29.945Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","resourceVersion":"115409","uid":"544dcd98-b37d-4269-af23-0d4485bbca38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.011Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:02Z"}],"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","resourceVersion":"115509","uid":"d7362fcf-6346-4177-8a82-a502664af493"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.077Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"}],"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","resourceVersion":"115018","uid":"f4130945-c9d0-41b2-a0a6-41cb06e58f4e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.142Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:07Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:57Z"}],"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","resourceVersion":"115259","uid":"aae853cf-0a4e-4aeb-a9d1-e210ae871fc6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.207Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"}],"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","resourceVersion":"115169","uid":"c8f8cd08-2a0f-4e20-a30b-5e6ca75dc31e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.273Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"}],"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","resourceVersion":"115128","uid":"f0b58eae-b5a7-4dc6-88bf-c1cb6e8b2bb6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.338Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"}],"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","resourceVersion":"115126","uid":"5199cd06-551e-406b-bee6-d4d24c5d5c84"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.406Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","resourceVersion":"115237","uid":"9ab9be04-60a7-4454-ba4d-ca03f4b8f174"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.471Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:54Z"}],"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","resourceVersion":"115146","uid":"745d7dea-a67a-4a7b-907d-673608c2af48"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.536Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","resourceVersion":"115453","uid":"591b2c08-f8dd-44ee-85ae-148c50d87e9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.602Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:55Z"}],"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","resourceVersion":"115198","uid":"e8d2a952-464c-46fe-a26d-8065101e10ba"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.667Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:55Z"}],"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","resourceVersion":"115214","uid":"991fcc4c-9d1b-4b64-a94d-e09ed894da1f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","resourceVersion":"115398","uid":"7fb18842-43f0-4afd-8bd4-52524a4d528d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.800Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","resourceVersion":"115387","uid":"2ebc719a-5efd-4f44-8a8b-a20427dd08a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.865Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:35Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:55Z"}],"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","resourceVersion":"115186","uid":"4cb69f08-179a-469d-b779-b7042c6da4e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.931Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","resourceVersion":"115424","uid":"45307783-5fa5-44e4-9063-d54dd5c04711"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:30.996Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","resourceVersion":"115496","uid":"e3004949-e35c-4e9b-a643-a948028f20b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.061Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","resourceVersion":"115417","uid":"3cadb7fb-34bb-4384-9baa-8b2e676dc6c0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.127Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","resourceVersion":"115241","uid":"a2510f1b-a9b0-4a9c-bb15-c4621eb0422a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.192Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","resourceVersion":"115384","uid":"bdcf0562-2434-42f0-af93-c1f674e609f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.258Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"}],"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","resourceVersion":"115256","uid":"ea93d085-96bb-46ba-9258-16618433a0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","resourceVersion":"115404","uid":"b7d3a13b-e331-4e9f-a8d3-441262d963cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.389Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","resourceVersion":"115483","uid":"4789cda5-d34c-48f9-9bdd-b029016fb3a4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.455Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"}],"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","resourceVersion":"115172","uid":"df6222c5-f966-4567-b1d3-714862434505"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.520Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:55Z"}],"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","resourceVersion":"115176","uid":"5d17b531-e50a-4506-bef1-8eaa2cb8960f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.586Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":"2026-11-04T00:04:15Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system","resourceVersion":"115440","uid":"4b4b4404-04ab-47e7-9b6a-155abf48ee04"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.652Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","resourceVersion":"115477","uid":"4789dc1d-0b51-4a6f-b176-5aee3fa5eb1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.719Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:59Z"}],"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","resourceVersion":"115407","uid":"91fc9973-eae8-42fa-8bdc-767a7bbb76d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.784Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:02Z"}],"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","resourceVersion":"115525","uid":"7ee97d41-8f87-4354-84af-b7e57b6b4bd3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.850Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:57Z"}],"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","resourceVersion":"115299","uid":"7290bf08-747f-4535-bdb4-b77f131ebf07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.915Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","resourceVersion":"115481","uid":"225cedac-fad9-4cca-aea2-ff0dda2db89d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:31.981Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"}],"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","resourceVersion":"115072","uid":"5259cba1-fb24-4243-b768-481e6b8a2f74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.047Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:55Z"}],"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","resourceVersion":"115181","uid":"4aeba8f0-1b34-4470-8415-8c1009b56810"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.114Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:51Z"}],"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","resourceVersion":"115002","uid":"efe4bf6b-05b6-403d-802c-6d695d0e65d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.180Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:55Z"}],"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","resourceVersion":"115196","uid":"1a9f71de-b6a8-4351-92e5-78cbcf89ab07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.247Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:00Z"}],"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","resourceVersion":"115437","uid":"97d1e99e-db75-43ed-8e5c-d1ef7cbfcc8a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.313Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:58Z"}],"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","resourceVersion":"115366","uid":"8fea2396-6c61-4b0e-897e-a9ba0e797161"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.379Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:58Z"}],"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","resourceVersion":"115368","uid":"4b122b12-2473-4ae0-9741-fd52f84809db"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.445Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"}],"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","resourceVersion":"115120","uid":"a3a8f190-0b70-4fce-975e-ca63be466540"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.511Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:54Z"}],"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","resourceVersion":"115154","uid":"0d8715b8-d57a-454f-a76b-daeba49ae132"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.576Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:54Z"}],"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","resourceVersion":"115161","uid":"6a0aa075-2a97-4b6b-8291-ea7177f180e8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.641Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","resourceVersion":"115473","uid":"c0fe5844-d101-40b6-a43e-969837f9e0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.707Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:08Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"}],"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","resourceVersion":"115113","uid":"8d56271a-0715-4609-9700-c88e7b27e0fe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.772Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:02Z"}],"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","resourceVersion":"115507","uid":"603b420f-4ff7-4b67-99f4-1e8d3f9cbcf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.838Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","resourceVersion":"115494","uid":"82865439-7052-4692-af5e-0f30c505ccb7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.904Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:53Z"}],"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","resourceVersion":"115098","uid":"1ed933c4-6946-4544-8f9c-f46f7e0d062a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:32.971Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:54Z"}],"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","resourceVersion":"115164","uid":"05c7120a-82ee-4fee-846a-4e3841beb2e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.037Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:57Z"}],"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","resourceVersion":"115326","uid":"7dd02dee-21f8-4e8f-8bcf-34f7283568b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.104Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","resourceVersion":"115244","uid":"b00ecfbf-ecc6-4817-b8c1-f0a5c174415a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.170Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:01Z"}],"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","resourceVersion":"115498","uid":"5aecf4b8-cefb-471c-94ac-d3451688a75b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.235Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:51Z"}],"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","resourceVersion":"114994","uid":"436fe831-e0eb-4ef6-ba18-665342a6c7f4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.301Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:54Z"}],"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","resourceVersion":"115136","uid":"8f728668-caee-43f7-9724-558cf8503a70"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.366Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:53Z"}],"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","resourceVersion":"115123","uid":"03510a5d-12ad-47ac-8aa3-861a3474a6ef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.432Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:16Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:52Z"}],"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","resourceVersion":"115022","uid":"68046133-2e5e-4698-9fff-9ef40e5ac5d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.498Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:02:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:02:02Z"}],"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","resourceVersion":"115555","uid":"5c3c058c-07cf-4597-81f0-f0a0e6273d1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.564Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:01:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:01:56Z"}],"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","resourceVersion":"115226","uid":"4b310763-fcf4-40d4-b60d-82c26edb4d30"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:33.619Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9cce52ec71ab42d40ce52632bc73cd4560b3b5876895f6e4525efd6f96eb7d49","error":"authconfigs.authorino.kuadrant.io \"9cce52ec71ab42d40ce52632bc73cd4560b3b5876895f6e4525efd6f96eb7d49\" not found"}
{"level":"error","ts":"2026-11-04T01:08:33.674Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3008a549a1f11eb28dba103a36e2dc30ca606a79dd7edfd737c43383d8f5e9d5","error":"authconfigs.authorino.kuadrant.io \"3008a549a1f11eb28dba103a36e2dc30ca606a79dd7edfd737c43383d8f5e9d5\" not found"}
{"level":"error","ts":"2026-11-04T01:08:33.728Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f5527ef59ffe7c7aa0b889222ac38f891a67cc6be82b6601bcff972925491ad7","error":"authconfigs.authorino.kuadrant.io \"f5527ef59ffe7c7aa0b889222ac38f891a67cc6be82b6601bcff972925491ad7\" not found"}
{"level":"error","ts":"2026-11-04T01:08:33.782Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f6dfe43b421fc9c5dd7fd8515b3d0226050a46aef05c7765ca1968216eb3e8a0","error":"authconfigs.authorino.kuadrant.io \"f6dfe43b421fc9c5dd7fd8515b3d0226050a46aef05c7765ca1968216eb3e8a0\" not found"}
{"level":"error","ts":"2026-11-04T01:08:33.837Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/98753ab3d502f282509b6641477cd85e246f5270a9017703ff15087af1385084","error":"authconfigs.authorino.kuadrant.io \"98753ab3d502f282509b6641477cd85e246f5270a9017703ff15087af1385084\" not found"}
{"level":"error","ts":"2026-11-04T01:08:33.891Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4da648f6d55f76bae857165a176a2b27a28052812b19545b112fe548074852aa","error":"authconfigs.authorino.kuadrant.io \"4da648f6d55f76bae857165a176a2b27a28052812b19545b112fe548074852aa\" not found"}
{"level":"error","ts":"2026-11-04T01:08:33.945Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ddf553d6b6de3b2456da5532833ec764e1be0634c0ee594b281df5fb3c451408","error":"authconfigs.authorino.kuadrant.io \"ddf553d6b6de3b2456da5532833ec764e1be0634c0ee594b281df5fb3c451408\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.000Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c1209850d5d9078dad25d4a320053d7dbd28ffc284e201aa002204c51b3c8094","error":"authconfigs.authorino.kuadrant.io \"c1209850d5d9078dad25d4a320053d7dbd28ffc284e201aa002204c51b3c8094\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.054Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fa5ac5712a3fe38d1618e8aaf701ad80f5b1fcffbbc2b86bdbb08c041ecb0c90","error":"authconfigs.authorino.kuadrant.io \"fa5ac5712a3fe38d1618e8aaf701ad80f5b1fcffbbc2b86bdbb08c041ecb0c90\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.109Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e25807b82eae74ce7dd1b3c8dfaca85972f907346453e17834ba173de5b0433c","error":"authconfigs.authorino.kuadrant.io \"e25807b82eae74ce7dd1b3c8dfaca85972f907346453e17834ba173de5b0433c\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.163Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0a2573f75977e237be8837c17472a6e1f605a4fe91ca3eff85d99035c112e995","error":"authconfigs.authorino.kuadrant.io \"0a2573f75977e237be8837c17472a6e1f605a4fe91ca3eff85d99035c112e995\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.217Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a1d983b2d0467e6b24b9511aacf5fb34002d688739d94d0cd86f0f9452f5a582","error":"authconfigs.authorino.kuadrant.io \"a1d983b2d0467e6b24b9511aacf5fb34002d688739d94d0cd86f0f9452f5a582\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.272Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/24eb75d55ca52fceb7e7bb6f7765e398b09c5a0e93669d990486fef52a245eb6","error":"authconfigs.authorino.kuadrant.io \"24eb75d55ca52fceb7e7bb6f7765e398b09c5a0e93669d990486fef52a245eb6\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.326Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6150b1c7b4ae604d4decbbceeb3c6647a6475ef97c716f51e964586a503f12d4","error":"authconfigs.authorino.kuadrant.io \"6150b1c7b4ae604d4decbbceeb3c6647a6475ef97c716f51e964586a503f12d4\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.381Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ca6e1d10764350ac0daf02018a5d29254ddd63cad1cc3da1c30ddda5bc296620","error":"authconfigs.authorino.kuadrant.io \"ca6e1d10764350ac0daf02018a5d29254ddd63cad1cc3da1c30ddda5bc296620\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.435Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3e0593105546c83bf5a2b760d8d828002520d6ac21df86ab2feee5253632714b","error":"authconfigs.authorino.kuadrant.io \"3e0593105546c83bf5a2b760d8d828002520d6ac21df86ab2feee5253632714b\" not found"}
{"level":"error","ts":"2026-11-04T01:08:34.502Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-80f48d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-b-80f48d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:35.710Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-80f48d","namespace":"openshift-ingress","uid":"b0b57090-b8ec-43f2-9a0f-0d9f68e32e5f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-80f48d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:35.873Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:36.006Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-b-2f5c48-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-b-2f5c48-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T01:08:36.424Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:36.424Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:08:37.240Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:08:38.015Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-2f5c48","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-b-2f5c48\" not found"}
{"level":"info","ts":"2026-11-04T01:08:45.870Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","TokenRateLimitPolicy","ConfigMap","AuthPolicy","EnvoyFilter","Gateway","Limitador"],"eventTypes":{"create":1,"delete":21,"update":109}}
{"level":"info","ts":"2026-11-04T01:08:46.311Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:48.438Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:08:48.732Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:08:48.732Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","reconcileID":"c6388ae9-f9a6-41dd-b06b-1963c95af0ab","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","reconcileID":"c6388ae9-f9a6-41dd-b06b-1963c95af0ab","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-9298a8","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-9298a8","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-9298a8\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:08:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:08:53.570Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:08:53.584Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:53.614Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:08:53.617Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:08:53.619Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:53.619Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:08:53.743Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:08:54.703Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-9298a8","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:03:00Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"77ac67af-dba8-4af8-b3d4-31957853fa97\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:03:00Z"}],"name":"kuadrant-e2e-inf-a-9298a8","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-9298a8","uid":"77ac67af-dba8-4af8-b3d4-31957853fa97"}],"resourceVersion":"117382","uid":"741a8d46-e582-4af4-befd-a762fa466bf3"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f5eb6125bbfb877012d6c24f2b5a9ccc99e37d3df80616a209f34cee3cadadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-9298a8-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]}],\"name\":\"eb213a60b90a730b88ebfc14ad8c6b61768e76e81f216f5c43a93f55544893ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e13f4db0d81d927c65277e86293936c923dcc4d608ec4730435cd39ee3d18bcf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-9298a8-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]}],\"name\":\"ecf8d354c515ffa1d7b08b28e60aba6f00e2c2b576c1c25cab5102a547de3469\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"016d03f69c8fa674d2ba9fea3298eab06bfd8463cb41169babae2271f81f629e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-9298a8-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]}],\"name\":\"ffe2af190ac605c962f12527d9bfe137fce8f283671ee6764affdcff0969ffe9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67559daa3a6e3d2d34f9d9b6211ab5e522a95eb42f1c701d5244b9a02907621e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-9298a8-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]}],\"name\":\"99749f5a863bc2900995aecd72052958d67f9a505b0105474b936d33c26bea0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8594543757b6340f67a5dd0992ff224c4452919f4113ed9b0812d1f942494d4f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-9298a8-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]}],\"name\":\"3ab3f55422b281ba66c28bf14ac6b1ec01eee540d97a6dfe30419fb98402c1b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d711c01cb9f56e456025bce04632fdc7ac4677c698150162795f2812469ca916\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-9298a8-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6b262936\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-9298a8\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-9298a8\"]}],\"name\":\"de120122a9a9e9d56c718fca88bc7f6111b58b0031c84fbca93bcd5709b67b42\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-9298a8"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-9298a8\" not found"}
{"level":"error","ts":"2026-11-04T01:08:56.505Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-9298a8-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-a-9298a8-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:08:57.717Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-9298a8","namespace":"openshift-ingress","uid":"90c5fdc3-2da8-4a7b-85a6-aafb1af1f6b7","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-9298a8\" not found"}
{"level":"info","ts":"2026-11-04T01:08:57.980Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:08:57.980Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:08:59.197Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-9298a8","error":"gateways.gateway.networking.k8s.io \"e2e-inf-a-9298a8\" not found"}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","reconcileID":"45fc9ed9-0da7-4cad-b309-80d41e71bb6d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","reconcileID":"45fc9ed9-0da7-4cad-b309-80d41e71bb6d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80fc0d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80fc0d","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-b-80fc0d\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:09:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:07.209Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","EnvoyFilter","AuthPolicy","AuthConfig","Gateway","ConfigMap","HTTPRoute","Limitador","TokenRateLimitPolicy"],"eventTypes":{"create":4,"delete":9,"update":7}}
{"level":"info","ts":"2026-11-04T01:09:07.621Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:07.641Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:11.538Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:09:11.726Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:09:11.856Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:09:11.857Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:09:11.857Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:09:15.377Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:09:15.413Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:15.413Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:09:15.415Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:15.415Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:09:15.420Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:09:15.452Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-inf-b-80fc0d","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-b-80fc0d\" not found"}
{"level":"error","ts":"2026-11-04T01:09:15.452Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-inf-b-80fc0d","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-b-80fc0d\" not found"}
{"level":"error","ts":"2026-11-04T01:09:15.491Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:09:15.491Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:09:16.083Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-80fc0d","envoyfilter":"openshift-ingress/kuadrant-e2e-inf-b-80fc0d","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-80fc0d\" not found"}
{"level":"error","ts":"2026-11-04T01:09:17.429Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-80fc0d-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-80fc0d-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:09:17.909Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:09:18.777Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:09:19.145Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:19.145Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:09:19.971Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-80fc0d","error":"gateways.gateway.networking.k8s.io \"e2e-inf-b-80fc0d\" not found"}
{"level":"error","ts":"2026-11-04T01:09:20.031Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-5a9ba2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-5a9ba2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:09:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","reconcileID":"9a346b44-d8f1-4ec3-96a8-5683810ed658","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:09:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:09:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:09:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:09:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","reconcileID":"05c5b60a-6482-4044-b48d-a900375af1eb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:09:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","reconcileID":"f3e357bd-b59c-4688-a808-b1be3307c2fe","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:09:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","reconcileID":"57ea55bc-7944-4bf8-9e32-06329f4edb21","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","reconcileID":"57ea55bc-7944-4bf8-9e32-06329f4edb21","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-61d74f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-61d74f","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-61d74f\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:09:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:33.247Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Limitador","AuthPolicy","Kuadrant","TokenRateLimitPolicy","ConfigMap","HTTPRoute","EnvoyFilter","AuthConfig"],"eventTypes":{"create":3,"delete":17,"update":6}}
{"level":"info","ts":"2026-11-04T01:09:33.666Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:33.686Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:36.757Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:09:37.243Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:09:37.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:09:37.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:09:37.414Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cb2be0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cb2be0","reconcileID":"df4486f9-9927-4ebb-a98c-e61f21d64b8f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-cb2be0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cb2be0","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cb2be0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cb2be0","reconcileID":"df4486f9-9927-4ebb-a98c-e61f21d64b8f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-cb2be0","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cb2be0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cb2be0","reconcileID":"81e0023c-7b21-4309-a920-85027bd2e153","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-b-cb2be0\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cb2be0","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-b-cb2be0\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:09:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:41.300Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:09:41.300Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:41.318Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:09:41.319Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:09:41.327Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:41.327Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:09:41.538Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:09:51.273Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-cb2be0","namespace":"openshift-ingress","uid":"cd1322a5-2f4d-460a-a3c8-3488788f8149","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-cb2be0\" not found"}
{"level":"error","ts":"2026-11-04T01:09:52.424Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:09:53.065Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:53.065Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:09:54.003Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-cb2be0","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-cb2be0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:09:54.978Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Kuadrant","TokenRateLimitPolicy","EnvoyFilter","HTTPRoute","Gateway"],"eventTypes":{"delete":7,"update":2}}
{"level":"info","ts":"2026-11-04T01:09:55.284Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:55.304Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","reconcileID":"38235b74-1b34-44ed-8b59-4cacc1477f4e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","reconcileID":"38235b74-1b34-44ed-8b59-4cacc1477f4e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-b5c4bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-b5c4bc","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-b5c4bc\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:09:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:09:59.873Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:09:59.949Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:10:00.033Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:10:00.034Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:10:00.132Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:10:04.142Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:10:04.146Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:10:04.153Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:10:04.154Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:10:04.154Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:10:04.156Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:10:04.215Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-5a9ba2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-inf-a-5a9ba2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-5a9ba2","uid":"fd76eec4-f7c1-49a6-b3dd-e0878f96b91b"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-5a9ba2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-a-5a9ba2\" already exists"}
{"level":"error","ts":"2026-11-04T01:10:04.261Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:15Z"}],"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system","resourceVersion":"124935","uid":"62c7cacb-180e-4c90-b5d6-1c407e60ad8d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.310Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-5a9ba2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-inf-a-5a9ba2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-5a9ba2","uid":"fd76eec4-f7c1-49a6-b3dd-e0878f96b91b"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-5a9ba2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-a-5a9ba2\" already exists"}
{"level":"error","ts":"2026-11-04T01:10:04.311Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:10:04.311Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:10:04.326Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:09Z"}],"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","resourceVersion":"124670","uid":"46cd51d3-5f06-4d20-b71e-1f0b4db592de"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.391Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:15Z"}],"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","resourceVersion":"124929","uid":"c6683eb7-c87e-4ca2-82c1-0a26a13c0533"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.461Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","resourceVersion":"124848","uid":"7dd02dee-21f8-4e8f-8bcf-34f7283568b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.577Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c#rule-1"},"creationTimestamp":"2026-11-04T01:08:53Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:54Z"}],"name":"a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108","namespace":"kuadrant-system","resourceVersion":"125643","uid":"c10337bb-d94a-4f23-92a4-2e1422a669e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.642Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","resourceVersion":"124917","uid":"ce55126a-2797-4172-b44f-58d5fa61ef97"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.694Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-cb2be0","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:06:52Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"13fbaaaa-6680-4a86-b385-a3aa60f1a12c\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:06:52Z"}],"name":"kuadrant-e2e-inf-b-cb2be0","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-cb2be0","uid":"13fbaaaa-6680-4a86-b385-a3aa60f1a12c"}],"resourceVersion":"122520","uid":"68c7274e-9253-436e-a1b8-75bca00222bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2d29c0d7e2800a0e07e33e842f3b2faa77cba50f5d98062d506930d76d92921\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cb2be0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]}],\"name\":\"ce82168a086ec24e1323196906bcb3d78c65c6d885d9eecc9a5884b0026afe6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ccfc0175501c42617c2227082a845fca4eefdb0d6262b02f9a711457dd9a2ef8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cb2be0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]}],\"name\":\"44dde030ebe000dd1a2a2b7953bc4650f06ca104933b80bc4a39dc1a6b57f6ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2466aec27264d8cea5b215d22b5581db3a2cd9e94b9df2a0c3ac63910e6957a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cb2be0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]}],\"name\":\"3701f5d24d3ecce4c96b27cd533b267c75f3cd7ecd679e0503ed960a34c5c06c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c583785ebe9b214453236810e624c77a9bb61206cf47ed3eb955143dad489e4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cb2be0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]}],\"name\":\"8112202b138162e7c1fa8298dea1060fd67c36b1eb20653acb230785f35db450\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af0d6cc59399945d057c1aec47f8ac1e46c4e2decf82725ff2934202c8c39535\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cb2be0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]}],\"name\":\"d2b4119f199ce97a62c84df5008ec9cb67410cef9b9ca7c7d74094eeba369ec2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"453735ce7447bf997ce86dec16831b7cc9c359e06947e25369674e539ea7242e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cb2be0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e9a5c73a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cb2be0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cb2be0\"]}],\"name\":\"e3b098866ac87310d6cf38122ea0cda6904813c4c5852ec0e482a3178a714852\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-cb2be0"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-cb2be0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.708Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","resourceVersion":"124866","uid":"a3cd9798-35c5-4e84-8035-49d9651e7466"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.774Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","resourceVersion":"124806","uid":"29639e67-1f6c-4127-bcb9-cce9ff973a39"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.856Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","resourceVersion":"124789","uid":"0c2279be-f80c-43ce-aa74-c6c4374682cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.922Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","resourceVersion":"124803","uid":"efe4bf6b-05b6-403d-802c-6d695d0e65d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:04.989Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c#rule-2"},"creationTimestamp":"2026-11-04T01:08:53Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:54Z"}],"name":"b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888","namespace":"kuadrant-system","resourceVersion":"125640","uid":"70b6445d-5bb0-42f1-8169-9b29104e78e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.063Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","resourceVersion":"124834","uid":"f67432a6-d4fc-4453-9f0c-4f3e66d88a3d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.139Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","resourceVersion":"124828","uid":"c7ad77a2-8814-49ae-98b8-eea0745f2dea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.204Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system","resourceVersion":"124891","uid":"da925041-7e60-4173-a86b-d5b45301b805"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.365Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","resourceVersion":"124747","uid":"5f83f408-3989-4587-955c-0d0e766e7b7c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.382Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:04:16Z","generation":20,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"af1b8c6b-0ceb-4134-aa61-de1746b60d18\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:54Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"af1b8c6b-0ceb-4134-aa61-de1746b60d18"}],"resourceVersion":"125653","uid":"edcce1ea-eb55-46d5-a2c7-9f7dda82aae1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e3901c2b2cfed52ba23e79de973be112e828f31b616edf4ec6ef5eadb30faa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-9b3fe3')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-9b3fe3/llm/e2e-dft-9b3fe3-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80c797de3cb5b3068274fc602bebf73e5d81426a3f12f22920dcea77dbb3523\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-9b3fe3')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b5c86f1031c74a67b381bc056d454d3fe49e459869b0331f21fdd6775e5c253d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-9b3fe3')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-9b3fe3/llm/e2e-dft-9b3fe3-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"c9c376725215e8a4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"269c4eb798afd99902368bd9fce4ad29fad353b98081b229c6c45ac8899c2ec6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-9b3fe3')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.431Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:07Z"}],"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","resourceVersion":"124595","uid":"f659bddd-ccbc-4880-9d50-b3379269187a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.450Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-5a9ba2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-inf-a-5a9ba2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-5a9ba2","uid":"fd76eec4-f7c1-49a6-b3dd-e0878f96b91b"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d5e69a896218323fd29644d5a87c17c59fc1e01e42e2d00482c28e469b1a72f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-5a9ba2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]}],\"name\":\"ad020dcd67cbaf4178669b34d2fd1927b9e69957245d940f3c402fdbce5e8aa6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d318298384bd3b3a9c17634a215d4c2099bb7dbc4a7e5cc2c4cb3244436a514\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-5a9ba2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]}],\"name\":\"bde4b96fd60c25b9d48a7778460e6f3c0691f4e4f8c278e7d5c46af6b3822a47\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"becb0e6493bcc212b4c34000d5749fbbd9908427f665fc91afadbbb9d489ef1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-5a9ba2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]}],\"name\":\"c621cf21ccc2db23283fb2fedf1a7c3820385247046437462964f83163442b03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a89e1896d3c25beda01ce3952d1683ec9c614f5a452fc316899cff51700f46db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-5a9ba2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]}],\"name\":\"44afea74305c8282b6a70ea6662d19ee413ed8970d7729ffec262068b5425ce0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ba7a670dac142cf7165322cdd89a41792fb854436aa3c709a757d19b6d55860b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-5a9ba2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]}],\"name\":\"56e2376761aab321665a5d97c11f0e392805e8b6623f508d985658091098584b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33002fc9049947421477e02a891f0abd3318d3a1905fc05de25733b44f3237bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-5a9ba2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ea54edc9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-5a9ba2\"]}],\"name\":\"d27fd72baeda5245907b812ce44188aaff24494194c5b46c63bc35fef2fc220c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-5a9ba2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-5a9ba2\" already exists"}
{"level":"error","ts":"2026-11-04T01:10:05.496Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system","resourceVersion":"124868","uid":"94e84cfc-05a1-4a7a-9c7c-93cb02e3fb46"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.562Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","resourceVersion":"124782","uid":"e8d2a952-464c-46fe-a26d-8065101e10ba"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.627Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","resourceVersion":"124897","uid":"c0fe5844-d101-40b6-a43e-969837f9e0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.692Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:09Z"}],"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","resourceVersion":"124667","uid":"5831c0c9-aa0b-49df-8c40-8305c69bb008"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.705Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-b5c4bc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:04:05Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4541c398-bf49-418c-ab3c-ea99f138ca0a\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:04:05Z"}],"name":"kuadrant-e2e-inf-a-b5c4bc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-b5c4bc","uid":"4541c398-bf49-418c-ab3c-ea99f138ca0a"}],"resourceVersion":"118899","uid":"f4cd6e9f-0158-4182-81ba-0969bd46671e"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ff8ad83cfc1b2bb9700bf26b69dd9246344c90dfad14373c2a24a94823d1d99\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"3c790f15f606e045e9147f1a562f8ec3f903c7d09c7fb67300ca942a9a85a9ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"881e323a1b5ba450c111b3ecf2e8e4b4631e4c5010cd9b41f7162abbe8314b07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"cf1370d11c52e11a47ebd9b0212a2266556b11e4ad665c1488daa30401c002fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6bb751712c9ad90e7f088c66ac404aa9f65e249afe80cd456aac1db0b0dc9331\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"19d819a7d39d808f9ff3490223bc0e7968ee9c894b2668c0ec87bb75b41a928a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6eb41a3076c4c0a6b52c5edcd2c9f0547731ffd8633d3b741d07877354ee7f69\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"f6dcfdbd3fb2835092523a5a19864258b6c5fafc470a872ac944ccaf6806adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1192709d9fcf6e965fc9fc07443e1414aa2ab670a15dea6f53167b3c09a3998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"708825876b3fe2048de77c9ce82d768acee5825e73d19136020108da7e0c5b82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1f1791f86ec1f2a4dcdc29ce424897741eef1a7990653966e300b98cb97dd85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-b5c4bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__9b058222\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-b5c4bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-b5c4bc\"]}],\"name\":\"eef46ed61aaff20c32d6b5b8bac107f7c99fdc3f12dfcc58359c93575304d2c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-b5c4bc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-b5c4bc\" not found"}
{"level":"error","ts":"2026-11-04T01:10:05.758Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","resourceVersion":"124811","uid":"97d1e99e-db75-43ed-8e5c-d1ef7cbfcc8a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.823Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","resourceVersion":"124918","uid":"6e833789-6bea-4b55-9954-107673397cb1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.890Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:06Z"}],"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","resourceVersion":"124529","uid":"bed19aa4-37ac-48f3-890d-4584e37ea205"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:05.956Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","resourceVersion":"124765","uid":"603b420f-4ff7-4b67-99f4-1e8d3f9cbcf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.020Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","resourceVersion":"124814","uid":"5294372c-e0b1-4ea7-952e-b2054adcabed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.085Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","resourceVersion":"124908","uid":"6a0aa075-2a97-4b6b-8291-ea7177f180e8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.151Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:05Z"}],"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","resourceVersion":"124459","uid":"a734419e-fb72-4d8c-8726-0cf49c79903b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.217Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:09Z"}],"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","resourceVersion":"124694","uid":"4aeba8f0-1b34-4470-8415-8c1009b56810"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.283Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:07Z"}],"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","resourceVersion":"124581","uid":"4df3ee09-24f5-46d6-af83-5d91cc9b6a3f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.348Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:06Z"}],"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","resourceVersion":"124518","uid":"0a533f9a-db7f-40ac-b074-215a942699d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.413Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","resourceVersion":"124819","uid":"28091510-d93c-4962-92f3-527e9404502d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.479Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","resourceVersion":"124840","uid":"28feee4f-561a-4d63-9877-c5bb7ff4d572"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.546Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","resourceVersion":"124900","uid":"2ebc719a-5efd-4f44-8a8b-a20427dd08a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.611Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:08Z"}],"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","resourceVersion":"124618","uid":"544dcd98-b37d-4269-af23-0d4485bbca38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.676Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c#rule-4"},"creationTimestamp":"2026-11-04T01:08:54Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:54Z"}],"name":"9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec","namespace":"kuadrant-system","resourceVersion":"125645","uid":"4c472f73-2267-4d46-b09a-f2f203ce3f56"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.742Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","resourceVersion":"124885","uid":"88066b40-e72f-45c3-9518-f4d65e7c02ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.813Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"becb0e6493bcc212b4c34000d5749fbbd9908427f665fc91afadbbb9d489ef1a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["becb0e6493bcc212b4c34000d5749fbbd9908427f665fc91afadbbb9d489ef1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"becb0e6493bcc212b4c34000d5749fbbd9908427f665fc91afadbbb9d489ef1a\" already exists"}
{"level":"error","ts":"2026-11-04T01:10:06.878Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","resourceVersion":"124704","uid":"680a2fbe-042b-4b0d-967b-f9c50d18d20c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:06.944Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:06Z"}],"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","resourceVersion":"124511","uid":"f0ec2b4b-b236-463a-b2a5-84c3f9b4ade2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.009Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","resourceVersion":"124754","uid":"4789cda5-d34c-48f9-9bdd-b029016fb3a4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.073Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","resourceVersion":"124898","uid":"5199cd06-551e-406b-bee6-d4d24c5d5c84"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.138Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","resourceVersion":"124731","uid":"03510a5d-12ad-47ac-8aa3-861a3474a6ef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.206Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","resourceVersion":"124843","uid":"991fcc4c-9d1b-4b64-a94d-e09ed894da1f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.273Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:06Z"}],"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","resourceVersion":"124525","uid":"0d8715b8-d57a-454f-a76b-daeba49ae132"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.337Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","resourceVersion":"124862","uid":"eab2a7f4-0d1f-4109-b660-70398295531e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.403Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","resourceVersion":"124879","uid":"1ed933c4-6946-4544-8f9c-f46f7e0d062a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:15Z"}],"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","resourceVersion":"124942","uid":"5aecf4b8-cefb-471c-94ac-d3451688a75b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.533Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:06Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","resourceVersion":"124714","uid":"11563e4d-bd42-439e-953f-44d0dd5d96c5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.598Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","resourceVersion":"124793","uid":"d7362fcf-6346-4177-8a82-a502664af493"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.668Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2d5e69a896218323fd29644d5a87c17c59fc1e01e42e2d00482c28e469b1a72f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d5e69a896218323fd29644d5a87c17c59fc1e01e42e2d00482c28e469b1a72f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2d5e69a896218323fd29644d5a87c17c59fc1e01e42e2d00482c28e469b1a72f\" already exists"}
{"level":"error","ts":"2026-11-04T01:10:07.734Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:15Z"}],"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","resourceVersion":"124934","uid":"bdcf0562-2434-42f0-af93-c1f674e609f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.799Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","resourceVersion":"124858","uid":"8fea2396-6c61-4b0e-897e-a9ba0e797161"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.864Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system","resourceVersion":"124791","uid":"2bfa8997-be7f-413c-adee-59c5f62ebf9a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:07.930Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","resourceVersion":"124808","uid":"f8baf538-8b91-4b9d-93b4-3eb2ffb3dc44"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.000Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ba7a670dac142cf7165322cdd89a41792fb854436aa3c709a757d19b6d55860b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ba7a670dac142cf7165322cdd89a41792fb854436aa3c709a757d19b6d55860b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ba7a670dac142cf7165322cdd89a41792fb854436aa3c709a757d19b6d55860b\" already exists"}
{"level":"error","ts":"2026-11-04T01:10:08.065Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","resourceVersion":"124874","uid":"b7d3a13b-e331-4e9f-a8d3-441262d963cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.130Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:15Z"}],"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","resourceVersion":"124922","uid":"a3a8f190-0b70-4fce-975e-ca63be466540"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.195Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","resourceVersion":"124851","uid":"4b122b12-2473-4ae0-9741-fd52f84809db"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.261Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","resourceVersion":"124756","uid":"5259cba1-fb24-4243-b768-481e6b8a2f74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.326Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":"2026-11-04T00:04:15Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system","resourceVersion":"124837","uid":"4b4b4404-04ab-47e7-9b6a-155abf48ee04"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.392Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:09Z"}],"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","resourceVersion":"124682","uid":"1a9f71de-b6a8-4351-92e5-78cbcf89ab07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.457Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","resourceVersion":"124883","uid":"0f705ecf-bf9f-42c5-923c-9bcdb55dd17c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.523Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:07Z"}],"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","resourceVersion":"124602","uid":"3cadb7fb-34bb-4384-9baa-8b2e676dc6c0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.588Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","resourceVersion":"124742","uid":"436fe831-e0eb-4ef6-ba18-665342a6c7f4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.654Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"}],"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","resourceVersion":"124436","uid":"6327ba77-94b6-4bbb-bc8a-f883ff4a36e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.725Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a89e1896d3c25beda01ce3952d1683ec9c614f5a452fc316899cff51700f46db","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a89e1896d3c25beda01ce3952d1683ec9c614f5a452fc316899cff51700f46db"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a89e1896d3c25beda01ce3952d1683ec9c614f5a452fc316899cff51700f46db\" already exists"}
{"level":"error","ts":"2026-11-04T01:10:08.790Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","resourceVersion":"124698","uid":"f4ad64b4-da27-4c73-bd47-df0058b599ab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.856Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:06Z"}],"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","resourceVersion":"124524","uid":"05c7120a-82ee-4fee-846a-4e3841beb2e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.922Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","resourceVersion":"124780","uid":"7290bf08-747f-4535-bdb4-b77f131ebf07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:08.986Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c#rule-3"},"creationTimestamp":"2026-11-04T01:08:53Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:53Z"}],"name":"fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7","namespace":"kuadrant-system","resourceVersion":"125631","uid":"304c4987-246b-4a18-b4fb-3e18914c11e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.051Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","resourceVersion":"124761","uid":"7fb18842-43f0-4afd-8bd4-52524a4d528d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.116Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","resourceVersion":"124797","uid":"5d17b531-e50a-4506-bef1-8eaa2cb8960f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.180Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:08Z"}],"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","resourceVersion":"124606","uid":"4789dc1d-0b51-4a6f-b176-5aee3fa5eb1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.246Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:05Z"}],"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","resourceVersion":"124491","uid":"5c3c058c-07cf-4597-81f0-f0a0e6273d1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.311Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:09Z"}],"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","resourceVersion":"124675","uid":"91fc9973-eae8-42fa-8bdc-767a7bbb76d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.376Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:05Z"}],"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","resourceVersion":"124484","uid":"0790ee5c-e21f-4d7b-a394-c30498d06200"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.446Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"33002fc9049947421477e02a891f0abd3318d3a1905fc05de25733b44f3237bf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["33002fc9049947421477e02a891f0abd3318d3a1905fc05de25733b44f3237bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"33002fc9049947421477e02a891f0abd3318d3a1905fc05de25733b44f3237bf\" already exists"}
{"level":"error","ts":"2026-11-04T01:10:09.512Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:35Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","resourceVersion":"124889","uid":"4cb69f08-179a-469d-b779-b7042c6da4e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.577Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:15Z"}],"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","resourceVersion":"124932","uid":"a2510f1b-a9b0-4a9c-bb15-c4621eb0422a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.642Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:15Z"}],"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","resourceVersion":"124927","uid":"ffdd41f3-82af-40be-bb9b-040eb397f7ce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.712Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:09Z"}],"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system","resourceVersion":"124672","uid":"a0647f68-e21f-4ae8-a007-876e4afcedc1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.777Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:05Z"}],"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","resourceVersion":"124474","uid":"2e63465b-6b28-4996-9d9f-439009fe7879"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.843Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","resourceVersion":"124907","uid":"f0b58eae-b5a7-4dc6-88bf-c1cb6e8b2bb6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.908Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:07Z"}],"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","resourceVersion":"124562","uid":"df6222c5-f966-4567-b1d3-714862434505"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:09.973Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:07Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:08Z"}],"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","resourceVersion":"124614","uid":"aae853cf-0a4e-4aeb-a9d1-e210ae871fc6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.038Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:15Z"}],"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","resourceVersion":"124924","uid":"b1c16000-3633-41db-a343-82b238efb39f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.104Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","resourceVersion":"124735","uid":"b33246e7-0352-41d5-aeda-06370c4f2104"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.171Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","resourceVersion":"124771","uid":"4b310763-fcf4-40d4-b60d-82c26edb4d30"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.241Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:15Z"}],"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","resourceVersion":"124937","uid":"7ee97d41-8f87-4354-84af-b7e57b6b4bd3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.306Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","resourceVersion":"124783","uid":"c1d0e4d7-4c7d-4727-a7b1-d4a8f60ffa63"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.371Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","resourceVersion":"124894","uid":"591b2c08-f8dd-44ee-85ae-148c50d87e9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.438Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:07Z"}],"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","resourceVersion":"124567","uid":"81514f4e-cb8f-4022-b596-09cf37bd31d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.505Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","resourceVersion":"124830","uid":"745d7dea-a67a-4a7b-907d-673608c2af48"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.570Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","resourceVersion":"124904","uid":"2e619d3e-8a68-4182-997f-3ea90cc450a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.635Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","resourceVersion":"124893","uid":"f5aa5634-1eef-4c83-9de8-beb2bea42b54"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.700Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","resourceVersion":"124816","uid":"9ab9be04-60a7-4454-ba4d-ca03f4b8f174"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.813Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","resourceVersion":"124712","uid":"f4130945-c9d0-41b2-a0a6-41cb06e58f4e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.878Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","resourceVersion":"124911","uid":"e3004949-e35c-4e9b-a643-a948028f20b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:10.944Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:09Z"}],"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","resourceVersion":"124688","uid":"8f728668-caee-43f7-9724-558cf8503a70"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.027Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:12Z"}],"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","resourceVersion":"124822","uid":"82865439-7052-4692-af5e-0f30c505ccb7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.109Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:16Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","resourceVersion":"124855","uid":"68046133-2e5e-4698-9fff-9ef40e5ac5d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.176Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","resourceVersion":"124902","uid":"225cedac-fad9-4cca-aea2-ff0dda2db89d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.241Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:13Z"}],"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","resourceVersion":"124876","uid":"41c72840-cfaa-4309-bd59-f64cab0d82da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.308Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","resourceVersion":"124786","uid":"d7bcc5f6-9218-414f-b4a3-f8e8f42a7ea6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.375Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:08Z"}],"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","resourceVersion":"124620","uid":"749db18a-efd0-45ab-9944-de1d056f97d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.440Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:08Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:14Z"}],"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","resourceVersion":"124913","uid":"8d56271a-0715-4609-9700-c88e7b27e0fe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.511Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-5a9ba2#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5d318298384bd3b3a9c17634a215d4c2099bb7dbc4a7e5cc2c4cb3244436a514","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d318298384bd3b3a9c17634a215d4c2099bb7dbc4a7e5cc2c4cb3244436a514"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-5a9ba2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5d318298384bd3b3a9c17634a215d4c2099bb7dbc4a7e5cc2c4cb3244436a514\" already exists"}
{"level":"error","ts":"2026-11-04T01:10:11.577Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:08Z"}],"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","resourceVersion":"124623","uid":"45307783-5fa5-44e4-9063-d54dd5c04711"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.643Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:08Z"}],"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","resourceVersion":"124630","uid":"b00ecfbf-ecc6-4817-b8c1-f0a5c174415a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.709Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:11Z"}],"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","resourceVersion":"124800","uid":"9d1c31ae-1c67-4bcf-92ea-4206077e7438"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.779Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:10Z"}],"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","resourceVersion":"124752","uid":"c8f8cd08-2a0f-4e20-a30b-5e6ca75dc31e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.844Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":7,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:08:05Z"}],"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","resourceVersion":"124465","uid":"ea93d085-96bb-46ba-9258-16618433a0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:11.900Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/25763917c7fdb47ebf7520554318b14230962562b86afe2fcc2298aa2fad6a1e","error":"authconfigs.authorino.kuadrant.io \"25763917c7fdb47ebf7520554318b14230962562b86afe2fcc2298aa2fad6a1e\" not found"}
{"level":"error","ts":"2026-11-04T01:10:11.955Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5306c1a9fde4b001abf5a3ed880959196d88c41eea6685ceaa491440b6e0a099","error":"authconfigs.authorino.kuadrant.io \"5306c1a9fde4b001abf5a3ed880959196d88c41eea6685ceaa491440b6e0a099\" not found"}
{"level":"error","ts":"2026-11-04T01:10:12.009Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b336e392da371d0bbe6ce91e5e2ecaefaae2b3733949ec4f3c8d62ef95e27d33","error":"authconfigs.authorino.kuadrant.io \"b336e392da371d0bbe6ce91e5e2ecaefaae2b3733949ec4f3c8d62ef95e27d33\" not found"}
{"level":"error","ts":"2026-11-04T01:10:12.064Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/08499134ad6bc2a9350ede2526cd4c286df32395a1624c82fb9073747be747f6","error":"authconfigs.authorino.kuadrant.io \"08499134ad6bc2a9350ede2526cd4c286df32395a1624c82fb9073747be747f6\" not found"}
{"level":"error","ts":"2026-11-04T01:10:12.118Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/280cbca3104873a0248eaaea6355e07ddca8989cd3fd8d64761523e429892edb","error":"authconfigs.authorino.kuadrant.io \"280cbca3104873a0248eaaea6355e07ddca8989cd3fd8d64761523e429892edb\" not found"}
{"level":"error","ts":"2026-11-04T01:10:12.173Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c000946dbf9036227fd290d639975361a60a975dd10abb709a1c3faea4e16dec","error":"authconfigs.authorino.kuadrant.io \"c000946dbf9036227fd290d639975361a60a975dd10abb709a1c3faea4e16dec\" not found"}
{"level":"error","ts":"2026-11-04T01:10:12.413Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:12.478Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-5a9ba2","namespace":"openshift-ingress","uid":"7cf679df-cca6-4834-98d9-da1e3808a053","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-5a9ba2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:12.710Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-5a9ba2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-5a9ba2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:12.978Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-b5c4bc","namespace":"openshift-ingress","uid":"58a38c58-6d15-449a-b06e-3b2e1c685e41","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-b5c4bc\" not found"}
{"level":"error","ts":"2026-11-04T01:10:13.092Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-b5c4bc-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-a-b5c4bc-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:10:13.097Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-cb2be0","namespace":"openshift-ingress","uid":"cd1322a5-2f4d-460a-a3c8-3488788f8149","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-cb2be0\" not found"}
{"level":"error","ts":"2026-11-04T01:10:13.521Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:10:14.015Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:10:14.015Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:10:14.141Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-cb2be0","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-cb2be0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:14.498Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-inf-a-5a9ba2","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-inf-a-5a9ba2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:14.573Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-5a9ba2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-5a9ba2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:14.824Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-b5c4bc","error":"gateways.gateway.networking.k8s.io \"e2e-inf-a-b5c4bc\" not found"}
{"level":"info","ts":"2026-11-04T01:10:26.016Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","Kuadrant","EnvoyFilter","Limitador","HTTPRoute","TokenRateLimitPolicy","AuthPolicy","ConfigMap"],"eventTypes":{"create":9,"delete":15,"update":118}}
{"level":"info","ts":"2026-11-04T01:10:26.426Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:10:26.447Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:10:29.462Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:10:29.736Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:10:29.737Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:10:29.914Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:10:30.050Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:10:33.623Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:10:33.634Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:10:33.634Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:10:33.637Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:10:33.638Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:10:33.644Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:10:33.814Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:10:36.205Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:10:37.180Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:10:37.180Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:10:38.891Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T01:10:44.422Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:10:44.448Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:10:44.448Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:10:44.514Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-inf-b-cb2be0","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-b-cb2be0\" not found"}
{"level":"error","ts":"2026-11-04T01:10:44.570Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e1192709d9fcf6e965fc9fc07443e1414aa2ab670a15dea6f53167b3c09a3998","error":"authconfigs.authorino.kuadrant.io \"e1192709d9fcf6e965fc9fc07443e1414aa2ab670a15dea6f53167b3c09a3998\" not found"}
{"level":"error","ts":"2026-11-04T01:10:44.625Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9c583785ebe9b214453236810e624c77a9bb61206cf47ed3eb955143dad489e4","error":"authconfigs.authorino.kuadrant.io \"9c583785ebe9b214453236810e624c77a9bb61206cf47ed3eb955143dad489e4\" not found"}
{"level":"error","ts":"2026-11-04T01:10:44.679Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ccfc0175501c42617c2227082a845fca4eefdb0d6262b02f9a711457dd9a2ef8","error":"authconfigs.authorino.kuadrant.io \"ccfc0175501c42617c2227082a845fca4eefdb0d6262b02f9a711457dd9a2ef8\" not found"}
{"level":"error","ts":"2026-11-04T01:10:44.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2466aec27264d8cea5b215d22b5581db3a2cd9e94b9df2a0c3ac63910e6957a6","error":"authconfigs.authorino.kuadrant.io \"2466aec27264d8cea5b215d22b5581db3a2cd9e94b9df2a0c3ac63910e6957a6\" not found"}
{"level":"error","ts":"2026-11-04T01:10:44.787Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4ff8ad83cfc1b2bb9700bf26b69dd9246344c90dfad14373c2a24a94823d1d99","error":"authconfigs.authorino.kuadrant.io \"4ff8ad83cfc1b2bb9700bf26b69dd9246344c90dfad14373c2a24a94823d1d99\" not found"}
{"level":"error","ts":"2026-11-04T01:10:44.841Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/af0d6cc59399945d057c1aec47f8ac1e46c4e2decf82725ff2934202c8c39535","error":"authconfigs.authorino.kuadrant.io \"af0d6cc59399945d057c1aec47f8ac1e46c4e2decf82725ff2934202c8c39535\" not found"}
{"level":"error","ts":"2026-11-04T01:10:44.895Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/453735ce7447bf997ce86dec16831b7cc9c359e06947e25369674e539ea7242e","error":"authconfigs.authorino.kuadrant.io \"453735ce7447bf997ce86dec16831b7cc9c359e06947e25369674e539ea7242e\" not found"}
{"level":"error","ts":"2026-11-04T01:10:44.950Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6eb41a3076c4c0a6b52c5edcd2c9f0547731ffd8633d3b741d07877354ee7f69","error":"authconfigs.authorino.kuadrant.io \"6eb41a3076c4c0a6b52c5edcd2c9f0547731ffd8633d3b741d07877354ee7f69\" not found"}
{"level":"error","ts":"2026-11-04T01:10:45.010Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c1f1791f86ec1f2a4dcdc29ce424897741eef1a7990653966e300b98cb97dd85","error":"authconfigs.authorino.kuadrant.io \"c1f1791f86ec1f2a4dcdc29ce424897741eef1a7990653966e300b98cb97dd85\" not found"}
{"level":"error","ts":"2026-11-04T01:10:45.066Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6bb751712c9ad90e7f088c66ac404aa9f65e249afe80cd456aac1db0b0dc9331","error":"authconfigs.authorino.kuadrant.io \"6bb751712c9ad90e7f088c66ac404aa9f65e249afe80cd456aac1db0b0dc9331\" not found"}
{"level":"error","ts":"2026-11-04T01:10:45.120Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/881e323a1b5ba450c111b3ecf2e8e4b4631e4c5010cd9b41f7162abbe8314b07","error":"authconfigs.authorino.kuadrant.io \"881e323a1b5ba450c111b3ecf2e8e4b4631e4c5010cd9b41f7162abbe8314b07\" not found"}
{"level":"error","ts":"2026-11-04T01:10:45.175Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a2d29c0d7e2800a0e07e33e842f3b2faa77cba50f5d98062d506930d76d92921","error":"authconfigs.authorino.kuadrant.io \"a2d29c0d7e2800a0e07e33e842f3b2faa77cba50f5d98062d506930d76d92921\" not found"}
{"level":"error","ts":"2026-11-04T01:10:45.988Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-cb2be0","envoyfilter":"openshift-ingress/kuadrant-e2e-inf-b-cb2be0","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-cb2be0\" not found"}
{"level":"error","ts":"2026-11-04T01:10:46.623Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:46.836Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-5a9ba2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-5a9ba2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:47.128Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-cb2be0-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-b-cb2be0-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:10:47.913Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-cb2be0","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-cb2be0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:10:59.526Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","AuthPolicy","Limitador","TokenRateLimitPolicy","AuthConfig","EnvoyFilter"],"eventTypes":{"delete":15,"update":7}}
{"level":"info","ts":"2026-11-04T01:10:59.880Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:01.920Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:11:02.060Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:11:02.060Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:11:05.916Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:11:05.916Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:05.951Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:11:05.953Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:11:05.953Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:11:05.961Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:05.961Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:11:08.211Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:08.623Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-cb2be0-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-cb2be0-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T01:11:09.339Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:09.339Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:11:10.227Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-cb2be0","error":"gateways.gateway.networking.k8s.io \"e2e-inf-b-cb2be0\" not found"}
{"level":"info","ts":"2026-11-04T01:11:11.045Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T01:11:16.471Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:11:16.482Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:16.482Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:11:18.574Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:18.708Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-cb2be0-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-cb2be0-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:11:20.036Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-cb2be0","error":"gateways.gateway.networking.k8s.io \"e2e-inf-b-cb2be0\" not found"}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","reconcileID":"0f902761-84f6-4323-8b91-246732aadaef","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","reconcileID":"0f902761-84f6-4323-8b91-246732aadaef","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-80f48d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-80f48d","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-b-80f48d\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:11:31.575Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","AuthPolicy","ConfigMap","Gateway"],"eventTypes":{"delete":2,"update":25}}
{"level":"info","ts":"2026-11-04T01:11:31.973Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:34.648Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:11:34.746Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:11:34.746Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:11:38.024Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:11:38.035Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:38.035Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:11:38.039Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:38.039Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:11:38.046Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:11:38.124Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-inf-b-80f48d","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-b-80f48d\" not found"}
{"level":"error","ts":"2026-11-04T01:11:38.133Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-inf-b-80f48d","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-b-80f48d\" not found"}
{"level":"info","ts":"2026-11-04T01:11:38.198Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:11:38.713Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-80f48d","envoyfilter":"openshift-ingress/kuadrant-e2e-inf-b-80f48d","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-80f48d\" not found"}
{"level":"error","ts":"2026-11-04T01:11:39.788Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:39.949Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:40.297Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-80f48d-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-80f48d-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T01:11:41.332Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:41.332Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:11:41.966Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-80f48d","error":"gateways.gateway.networking.k8s.io \"e2e-inf-b-80f48d\" not found"}
{"level":"info","ts":"2026-11-04T01:11:42.979Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","Kuadrant","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":2,"update":3}}
{"level":"info","ts":"2026-11-04T01:11:43.232Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:43.253Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:46.358Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:11:46.358Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:11:46.427Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:11:46.448Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:11:46.448Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:11:48Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","reconcileID":"d127bf51-c69f-4cb3-8c44-58b834040c7b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:11:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:11:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:11:48Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:11:48Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:11:49Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:11:49Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","reconcileID":"d127bf51-c69f-4cb3-8c44-58b834040c7b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-5a9ba2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:11:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-5a9ba2","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:11:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:11:49Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-5a9ba2\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:11:49Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:11:50.131Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:50.141Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:11:50.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:50.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:11:50.131Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:11:50.157Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:11:50.230Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-inf-b-80f48d","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-b-80f48d\" not found"}
{"level":"error","ts":"2026-11-04T01:11:50.230Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-inf-b-80f48d","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-b-80f48d\" not found"}
{"level":"error","ts":"2026-11-04T01:11:50.247Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:11:50.247Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:11:50.315Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5d1eb709be0137affb4d4a83b9109d6633f540d62e319f915b4e66b6929ce53c","error":"authconfigs.authorino.kuadrant.io \"5d1eb709be0137affb4d4a83b9109d6633f540d62e319f915b4e66b6929ce53c\" not found"}
{"level":"error","ts":"2026-11-04T01:11:50.413Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ce78a94b811503ee854a1b3fccf6dc43c819d00b2684840b93b44aea189668ff","error":"authconfigs.authorino.kuadrant.io \"ce78a94b811503ee854a1b3fccf6dc43c819d00b2684840b93b44aea189668ff\" not found"}
{"level":"error","ts":"2026-11-04T01:11:50.528Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5f10150899ebf2058d0e222d92f0cb100c5ef9990225cbf92f7fdfa689dd7c7b","error":"authconfigs.authorino.kuadrant.io \"5f10150899ebf2058d0e222d92f0cb100c5ef9990225cbf92f7fdfa689dd7c7b\" not found"}
{"level":"error","ts":"2026-11-04T01:11:50.614Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/212e5d59f8206be67538e272d946ce14c070adbe2dc9e5b3e1a2ccc7392041fb","error":"authconfigs.authorino.kuadrant.io \"212e5d59f8206be67538e272d946ce14c070adbe2dc9e5b3e1a2ccc7392041fb\" not found"}
{"level":"error","ts":"2026-11-04T01:11:50.669Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3b1fbf7880928217b2d44b74a39b6347b269e717e1f9e0876c1c5cd21a7b063a","error":"authconfigs.authorino.kuadrant.io \"3b1fbf7880928217b2d44b74a39b6347b269e717e1f9e0876c1c5cd21a7b063a\" not found"}
{"level":"error","ts":"2026-11-04T01:11:50.724Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/afb56dda3d24278ec900984183532c96cbca69872c614d2040143b2ddc141261","error":"authconfigs.authorino.kuadrant.io \"afb56dda3d24278ec900984183532c96cbca69872c614d2040143b2ddc141261\" not found"}
{"level":"error","ts":"2026-11-04T01:11:51.357Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-80f48d","envoyfilter":"openshift-ingress/kuadrant-e2e-inf-b-80f48d","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-80f48d\" not found"}
{"level":"error","ts":"2026-11-04T01:11:52.121Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"ea94eee1-4fa1-4bbc-9fd0-abf6bb037f23","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.180Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress","uid":"8ee23743-8136-414a-befd-4823f1204662","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w1-7cdb6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.239Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0aca485e-d119-4f32-b55c-03a6cd2e4721","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.298Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.357Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.360Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-80f48d-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-80f48d-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:11:52.417Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress","uid":"bdb28298-f8ad-43b5-9aa4-51c38ea3fda9","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.475Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.537Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-5a9ba2","namespace":"openshift-ingress","uid":"7cf679df-cca6-4834-98d9-da1e3808a053","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-5a9ba2\" not found"}
{"level":"error","ts":"2026-11-04T01:11:52.616Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.617Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"9eac2b56-0401-454c-9ebc-14e89f9a7d31","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.675Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.858Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:52.921Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:53.040Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:53.099Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:53.158Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"9fe6b3b0-da60-4edb-8957-23a7e1176230","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:53.217Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"1a314f0b-0158-4346-9093-8734add83dc2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:53.276Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:53.335Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"65d485d3-1bfe-4c9b-9b36-4be0949afb65","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:53.393Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-7966af","namespace":"e2e-models-e2e-worker-w1-7966af","uid":"0b79d11c-12cd-4c4c-bd46-02bffcbd576b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:53.452Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:11:53.572Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"73358f98-af1a-45de-ac76-a04843381483","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:11:53.632Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:11:53.632Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:11:54.701Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-80f48d","error":"gateways.gateway.networking.k8s.io \"e2e-inf-b-80f48d\" not found"}
{"level":"error","ts":"2026-11-04T01:11:54.762Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-5a9ba2","error":"gateways.gateway.networking.k8s.io \"e2e-inf-a-5a9ba2\" not found"}
{"level":"info","ts":"2026-11-04T01:12:02.339Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap","Limitador","Kuadrant","AuthConfig","EnvoyFilter","Gateway","HTTPRoute"],"eventTypes":{"delete":18,"update":24}}
{"level":"info","ts":"2026-11-04T01:12:02.711Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:02.732Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:05.432Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:12:05.518Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:12:05.734Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:12:05.734Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:12:06.133Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:12:09.201Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:12:09.220Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:09.221Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:12:09.227Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:09.227Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:12:09.231Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:12:09.386Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:12:11.275Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:12:12.808Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:12.808Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:12:24.327Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Limitador","AuthPolicy","ConfigMap","AuthConfig"],"eventTypes":{"delete":6,"update":5}}
{"level":"info","ts":"2026-11-04T01:12:24.625Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:26.138Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:12:26.246Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:12:26.246Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:12:29.681Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:12:29.686Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:29.717Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:12:29.717Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:12:29.718Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:12:29.724Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:29.724Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:12:39.385Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:12:40.067Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:40.067Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:12:41.527Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T01:12:46.334Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:12:46.343Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:12:46.343Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:12:46.461Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","resourceVersion":"127102","uid":"5294372c-e0b1-4ea7-952e-b2054adcabed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:46.527Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","resourceVersion":"127083","uid":"f4130945-c9d0-41b2-a0a6-41cb06e58f4e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:46.613Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:47Z"}],"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","resourceVersion":"127001","uid":"91fc9973-eae8-42fa-8bdc-767a7bbb76d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:46.679Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","resourceVersion":"127197","uid":"bdcf0562-2434-42f0-af93-c1f674e609f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:46.778Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:43Z"}],"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","resourceVersion":"126857","uid":"a3cd9798-35c5-4e84-8035-49d9651e7466"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:46.844Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system","resourceVersion":"127170","uid":"a0647f68-e21f-4ae8-a007-876e4afcedc1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:46.910Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","resourceVersion":"127195","uid":"7fb18842-43f0-4afd-8bd4-52524a4d528d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:46.976Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","resourceVersion":"127032","uid":"4b122b12-2473-4ae0-9741-fd52f84809db"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.081Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","resourceVersion":"127134","uid":"c6683eb7-c87e-4ca2-82c1-0a26a13c0533"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.149Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:44Z"}],"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","resourceVersion":"126903","uid":"0790ee5c-e21f-4d7b-a394-c30498d06200"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.152Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:04:16Z","generation":22,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"af1b8c6b-0ceb-4134-aa61-de1746b60d18\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:10Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"af1b8c6b-0ceb-4134-aa61-de1746b60d18"}],"resourceVersion":"129992","uid":"edcce1ea-eb55-46d5-a2c7-9f7dda82aae1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e3901c2b2cfed52ba23e79de973be112e828f31b616edf4ec6ef5eadb30faa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-9b3fe3')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-9b3fe3/llm/e2e-dft-9b3fe3-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80c797de3cb5b3068274fc602bebf73e5d81426a3f12f22920dcea77dbb3523\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-dft-9b3fe3')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b5c86f1031c74a67b381bc056d454d3fe49e459869b0331f21fdd6775e5c253d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-9b3fe3')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-dft-9b3fe3/llm/e2e-dft-9b3fe3-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"046146288c8c6fbc\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"269c4eb798afd99902368bd9fce4ad29fad353b98081b229c6c45ac8899c2ec6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-dft-9b3fe3')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.214Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:44Z"}],"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","resourceVersion":"126899","uid":"9ab9be04-60a7-4454-ba4d-ca03f4b8f174"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.279Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","resourceVersion":"127163","uid":"a734419e-fb72-4d8c-8726-0cf49c79903b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.345Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:43Z"}],"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","resourceVersion":"126850","uid":"c0fe5844-d101-40b6-a43e-969837f9e0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.410Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","resourceVersion":"127145","uid":"03510a5d-12ad-47ac-8aa3-861a3474a6ef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.476Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","resourceVersion":"127067","uid":"2e63465b-6b28-4996-9d9f-439009fe7879"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:43Z"}],"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","resourceVersion":"126847","uid":"5199cd06-551e-406b-bee6-d4d24c5d5c84"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.606Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:45Z"}],"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","resourceVersion":"126932","uid":"544dcd98-b37d-4269-af23-0d4485bbca38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.673Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","resourceVersion":"127091","uid":"a3a8f190-0b70-4fce-975e-ca63be466540"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.738Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","resourceVersion":"127087","uid":"82865439-7052-4692-af5e-0f30c505ccb7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.803Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","resourceVersion":"127056","uid":"e3004949-e35c-4e9b-a643-a948028f20b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.868Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","resourceVersion":"126841","uid":"45307783-5fa5-44e4-9063-d54dd5c04711"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.933Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","resourceVersion":"127172","uid":"0c2279be-f80c-43ce-aa74-c6c4374682cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:47.998Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","resourceVersion":"127109","uid":"6e833789-6bea-4b55-9954-107673397cb1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.063Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:44Z"}],"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","resourceVersion":"126896","uid":"5831c0c9-aa0b-49df-8c40-8305c69bb008"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.128Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","resourceVersion":"127178","uid":"603b420f-4ff7-4b67-99f4-1e8d3f9cbcf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.193Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","resourceVersion":"127188","uid":"f4ad64b4-da27-4c73-bd47-df0058b599ab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.258Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system","resourceVersion":"127018","uid":"2bfa8997-be7f-413c-adee-59c5f62ebf9a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:47Z"}],"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","resourceVersion":"126989","uid":"f0ec2b4b-b236-463a-b2a5-84c3f9b4ade2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.389Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","resourceVersion":"127070","uid":"ea93d085-96bb-46ba-9258-16618433a0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:41Z"}],"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","resourceVersion":"126797","uid":"4aeba8f0-1b34-4470-8415-8c1009b56810"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.518Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","resourceVersion":"127174","uid":"97d1e99e-db75-43ed-8e5c-d1ef7cbfcc8a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.583Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","resourceVersion":"127201","uid":"bed19aa4-37ac-48f3-890d-4584e37ea205"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.648Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:35Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","resourceVersion":"127043","uid":"4cb69f08-179a-469d-b779-b7042c6da4e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.713Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","resourceVersion":"126805","uid":"f659bddd-ccbc-4880-9d50-b3379269187a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.778Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","resourceVersion":"127054","uid":"df6222c5-f966-4567-b1d3-714862434505"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.844Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","resourceVersion":"127200","uid":"f67432a6-d4fc-4453-9f0c-4f3e66d88a3d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.909Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","resourceVersion":"126807","uid":"1a9f71de-b6a8-4351-92e5-78cbcf89ab07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:48.975Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:06Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","resourceVersion":"127150","uid":"11563e4d-bd42-439e-953f-44d0dd5d96c5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.040Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","resourceVersion":"127209","uid":"ce55126a-2797-4172-b44f-58d5fa61ef97"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:47Z"}],"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","resourceVersion":"126995","uid":"c8f8cd08-2a0f-4e20-a30b-5e6ca75dc31e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.170Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","resourceVersion":"127149","uid":"7290bf08-747f-4535-bdb4-b77f131ebf07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.235Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","resourceVersion":"127105","uid":"4b310763-fcf4-40d4-b60d-82c26edb4d30"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.301Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","resourceVersion":"127205","uid":"0a533f9a-db7f-40ac-b074-215a942699d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.366Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","resourceVersion":"127165","uid":"8fea2396-6c61-4b0e-897e-a9ba0e797161"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.431Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:47Z"}],"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","resourceVersion":"126998","uid":"05c7120a-82ee-4fee-846a-4e3841beb2e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.496Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","resourceVersion":"127028","uid":"88066b40-e72f-45c3-9518-f4d65e7c02ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.561Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","resourceVersion":"127064","uid":"4df3ee09-24f5-46d6-af83-5d91cc9b6a3f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.627Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:44Z"}],"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","resourceVersion":"126911","uid":"e8d2a952-464c-46fe-a26d-8065101e10ba"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.692Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c#rule-1"},"creationTimestamp":"2026-11-04T01:08:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108","namespace":"kuadrant-system","resourceVersion":"127119","uid":"c10337bb-d94a-4f23-92a4-2e1422a669e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a3111d5102f4730994f6d6fc162f11386b03c2e58101ec1619da0f6558a71108\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.758Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","resourceVersion":"127037","uid":"4789dc1d-0b51-4a6f-b176-5aee3fa5eb1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.823Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","resourceVersion":"127141","uid":"efe4bf6b-05b6-403d-802c-6d695d0e65d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.888Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:07Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","resourceVersion":"126839","uid":"aae853cf-0a4e-4aeb-a9d1-e210ae871fc6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:49.953Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:47Z"}],"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","resourceVersion":"127005","uid":"b00ecfbf-ecc6-4817-b8c1-f0a5c174415a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.071Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","resourceVersion":"127175","uid":"81514f4e-cb8f-4022-b596-09cf37bd31d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.136Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","resourceVersion":"127034","uid":"c7ad77a2-8814-49ae-98b8-eea0745f2dea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.221Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","resourceVersion":"126817","uid":"a2510f1b-a9b0-4a9c-bb15-c4621eb0422a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.309Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system","resourceVersion":"127097","uid":"da925041-7e60-4173-a86b-d5b45301b805"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.381Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:08Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","resourceVersion":"127123","uid":"8d56271a-0715-4609-9700-c88e7b27e0fe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.448Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:41Z"}],"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","resourceVersion":"126779","uid":"ffdd41f3-82af-40be-bb9b-040eb397f7ce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.514Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","resourceVersion":"127147","uid":"749db18a-efd0-45ab-9944-de1d056f97d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.579Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:41Z"}],"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","resourceVersion":"126802","uid":"0d8715b8-d57a-454f-a76b-daeba49ae132"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.644Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","resourceVersion":"126823","uid":"d7bcc5f6-9218-414f-b4a3-f8e8f42a7ea6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.710Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","resourceVersion":"127181","uid":"436fe831-e0eb-4ef6-ba18-665342a6c7f4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.775Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","resourceVersion":"127016","uid":"4789cda5-d34c-48f9-9bdd-b029016fb3a4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.840Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","resourceVersion":"126820","uid":"225cedac-fad9-4cca-aea2-ff0dda2db89d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.905Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:45Z"}],"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","resourceVersion":"126917","uid":"28feee4f-561a-4d63-9877-c5bb7ff4d572"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:50.970Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","resourceVersion":"127160","uid":"3cadb7fb-34bb-4384-9baa-8b2e676dc6c0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.035Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:44Z"}],"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","resourceVersion":"126880","uid":"b7d3a13b-e331-4e9f-a8d3-441262d963cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.101Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","resourceVersion":"127076","uid":"9d1c31ae-1c67-4bcf-92ea-4206077e7438"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.167Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","resourceVersion":"127153","uid":"28091510-d93c-4962-92f3-527e9404502d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.232Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","resourceVersion":"127142","uid":"745d7dea-a67a-4a7b-907d-673608c2af48"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.298Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","resourceVersion":"126811","uid":"f8baf538-8b91-4b9d-93b4-3eb2ffb3dc44"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.363Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","resourceVersion":"126813","uid":"1ed933c4-6946-4544-8f9c-f46f7e0d062a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.428Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","resourceVersion":"127045","uid":"6327ba77-94b6-4bbb-bc8a-f883ff4a36e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.493Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","resourceVersion":"127040","uid":"b1c16000-3633-41db-a343-82b238efb39f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.559Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","resourceVersion":"127099","uid":"8f728668-caee-43f7-9724-558cf8503a70"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.624Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:44Z"}],"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","resourceVersion":"126891","uid":"eab2a7f4-0d1f-4109-b660-70398295531e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","resourceVersion":"127185","uid":"f5aa5634-1eef-4c83-9de8-beb2bea42b54"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.754Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","resourceVersion":"127154","uid":"5aecf4b8-cefb-471c-94ac-d3451688a75b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.819Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","resourceVersion":"127127","uid":"591b2c08-f8dd-44ee-85ae-148c50d87e9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.884Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","resourceVersion":"127193","uid":"5259cba1-fb24-4243-b768-481e6b8a2f74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:51.949Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","resourceVersion":"127014","uid":"29639e67-1f6c-4127-bcb9-cce9ff973a39"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.014Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system","resourceVersion":"127112","uid":"62c7cacb-180e-4c90-b5d6-1c407e60ad8d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.081Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c#rule-3"},"creationTimestamp":"2026-11-04T01:08:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7","namespace":"kuadrant-system","resourceVersion":"127191","uid":"304c4987-246b-4a18-b4fb-3e18914c11e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fcc4c4410ff30c2144aa52c3ee8d59b58f5f235a36ec22d888f60df89bcacdf7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.146Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","resourceVersion":"127060","uid":"0f705ecf-bf9f-42c5-923c-9bcdb55dd17c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.211Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:47Z"}],"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","resourceVersion":"127007","uid":"41c72840-cfaa-4309-bd59-f64cab0d82da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:50Z"}],"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","resourceVersion":"127094","uid":"991fcc4c-9d1b-4b64-a94d-e09ed894da1f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.342Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:43Z"}],"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","resourceVersion":"126856","uid":"2e619d3e-8a68-4182-997f-3ea90cc450a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.406Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":"2026-11-04T00:04:15Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system","resourceVersion":"127202","uid":"4b4b4404-04ab-47e7-9b6a-155abf48ee04"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.472Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","resourceVersion":"127176","uid":"2ebc719a-5efd-4f44-8a8b-a20427dd08a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.536Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","resourceVersion":"126825","uid":"d7362fcf-6346-4177-8a82-a502664af493"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.602Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","resourceVersion":"127139","uid":"5f83f408-3989-4587-955c-0d0e766e7b7c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.667Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","resourceVersion":"127049","uid":"46cd51d3-5f06-4d20-b71e-1f0b4db592de"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.734Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","resourceVersion":"127186","uid":"7dd02dee-21f8-4e8f-8bcf-34f7283568b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.799Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","resourceVersion":"127158","uid":"680a2fbe-042b-4b0d-967b-f9c50d18d20c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.864Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system","resourceVersion":"127216","uid":"94e84cfc-05a1-4a7a-9c7c-93cb02e3fb46"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.930Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:45Z"}],"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","resourceVersion":"126922","uid":"7ee97d41-8f87-4354-84af-b7e57b6b4bd3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:52.995Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c#rule-4"},"creationTimestamp":"2026-11-04T01:08:54Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:43Z"}],"name":"9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec","namespace":"kuadrant-system","resourceVersion":"126845","uid":"4c472f73-2267-4d46-b09a-f2f203ce3f56"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9f39b1d8b4128e2dea4bf82a69406cd86f29354fb6685744953572362bea32ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:53.060Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","resourceVersion":"127189","uid":"f0b58eae-b5a7-4dc6-88bf-c1cb6e8b2bb6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:53.126Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:53Z"}],"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","resourceVersion":"127203","uid":"5d17b531-e50a-4506-bef1-8eaa2cb8960f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:53.404Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-dft-9b3fe3-04c18a3ca22c#rule-2"},"creationTimestamp":"2026-11-04T01:08:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:52Z"}],"name":"b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888","namespace":"kuadrant-system","resourceVersion":"127184","uid":"70b6445d-5bb0-42f1-8169-9b29104e78e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b691c9e055336ff6a12c25ba1c0279aef8db11d958a3f1fa43fd1e1e1cdcf888\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:53.469Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:16Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:49Z"}],"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","resourceVersion":"127073","uid":"68046133-2e5e-4698-9fff-9ef40e5ac5d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:53.534Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:51Z"}],"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","resourceVersion":"127130","uid":"b33246e7-0352-41d5-aeda-06370c4f2104"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:53.599Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:48Z"}],"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","resourceVersion":"127026","uid":"6a0aa075-2a97-4b6b-8291-ea7177f180e8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:53.665Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","resourceVersion":"126834","uid":"c1d0e4d7-4c7d-4727-a7b1-d4a8f60ffa63"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:53.731Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":8,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:08:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:09:42Z"}],"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","resourceVersion":"126830","uid":"5c3c058c-07cf-4597-81f0-f0a0e6273d1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:12:54.550Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:13:05.959Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","EnvoyFilter","Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"update":130}}
{"level":"info","ts":"2026-11-04T01:13:06.351Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:07.940Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:13:08.116Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:13:08.116Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:13:11.519Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:13:11.531Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:11.531Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:13:11.538Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:11.539Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:13:11.544Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:13:11.544Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:13:13.366Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:13:14.431Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:14.436Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:13:14.909Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:13:15.958Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T01:13:21.261Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:13:21.273Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:21.273Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:13:25.136Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:13:26.275Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:13:35.398Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","ConfigMap","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"create":1,"delete":1,"update":4}}
{"level":"info","ts":"2026-11-04T01:13:40.935Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:13:40.943Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:40.950Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:13:40.964Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:40.964Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:13:41.014Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:13:41.093Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:13:43.056Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:13:44.658Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:44.658Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:13:52.896Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador","EnvoyFilter","AuthPolicy","AuthConfig"],"eventTypes":{"delete":4,"update":24}}
{"level":"info","ts":"2026-11-04T01:13:53.176Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:54.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:13:54.851Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:13:54.851Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:13:58.125Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:13:58.134Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:58.134Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:13:58.145Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:13:58.145Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:13:58.150Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:13:58.150Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:14:00.388Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:14:01.226Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:01.226Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:14:12.653Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"update":23}}
{"level":"info","ts":"2026-11-04T01:14:13.039Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:14.725Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:14:14.914Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:14:14.914Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:14:18.032Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:14:18.045Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:18.045Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:14:18.054Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:18.054Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:14:18.060Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:14:18.060Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:14:19.895Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:14:21.029Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:21.029Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:14:22.557Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T01:14:27.625Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:14:27.648Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:27.648Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:14:29.501Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:14:30.239Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-567653","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-567653\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:14:30Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-567653","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-567653","reconcileID":"958c7f6f-8534-4fc6-8bac-307fb26db4b4","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-567653","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:14:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-567653","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:14:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-567653","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-567653","reconcileID":"21675c04-95bf-4cd2-bdac-e4c054cb695f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-567653","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-567653","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:14:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:14:38.195Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","HTTPRoute","AuthPolicy","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"create":3,"update":4}}
{"level":"info","ts":"2026-11-04T01:14:38.593Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:38.613Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:41.314Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:14:41.635Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:14:41.829Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:14:41.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:14:41.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:14:44.966Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:44.966Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:14:44.973Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:14:44.974Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:14:44.985Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:44.985Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:14:45.126Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:14:47.659Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:14:48.237Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:48.237Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:14:56.468Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador","HTTPRoute","AuthConfig","EnvoyFilter","Gateway","AuthPolicy"],"eventTypes":{"create":9,"update":27}}
{"level":"info","ts":"2026-11-04T01:14:56.866Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:14:58.925Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:14:59.140Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:14:59.141Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:15:03.074Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:15:03.074Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:03.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:15:03.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:15:03.114Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:15:03.124Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:03.124Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:15:05.169Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:15:06.463Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:06.463Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:15:14.991Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","Gateway","AuthPolicy","ConfigMap"],"eventTypes":{"create":1,"update":25}}
{"level":"info","ts":"2026-11-04T01:15:15.389Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:17.545Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:15:17.728Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:15:17.728Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:15:22.087Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:15:22.124Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:22.124Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:15:22.131Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:22.131Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:15:22.137Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:15:22.137Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:15:24.498Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:15:25.153Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:25.153Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:15:25.880Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-238db1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:15:36.683Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute","AuthPolicy"],"eventTypes":{"create":1,"update":3}}
{"level":"info","ts":"2026-11-04T01:15:42.547Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:15:42.552Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:42.558Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:42.558Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:15:42.558Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:15:42.562Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:15:42.714Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:15:51.893Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:15:53.371Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:15:53.371Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:15:55.058Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T01:16:00.254Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:16:00.320Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:00.320Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:16:00.371Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","resourceVersion":"130706","uid":"c0fe5844-d101-40b6-a43e-969837f9e0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.436Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","resourceVersion":"130632","uid":"4b122b12-2473-4ae0-9741-fd52f84809db"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.501Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"}],"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","resourceVersion":"130382","uid":"29639e67-1f6c-4127-bcb9-cce9ff973a39"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.568Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","resourceVersion":"130613","uid":"82865439-7052-4692-af5e-0f30c505ccb7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.634Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","resourceVersion":"130619","uid":"df6222c5-f966-4567-b1d3-714862434505"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.699Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","resourceVersion":"130607","uid":"45307783-5fa5-44e4-9063-d54dd5c04711"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.764Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:33Z"}],"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","resourceVersion":"130498","uid":"5199cd06-551e-406b-bee6-d4d24c5d5c84"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.829Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","resourceVersion":"130600","uid":"88066b40-e72f-45c3-9518-f4d65e7c02ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.877Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-238db1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:42:33Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"a871959e-14fe-46d3-b8f2-00d3bcc71d04\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:52:50Z"}],"name":"kuadrant-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-238db1","uid":"a871959e-14fe-46d3-b8f2-00d3bcc71d04"}],"resourceVersion":"100937","uid":"35f27ffc-a00a-4ce9-943f-67b61b438389"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"6ef80f559a73a24f963616437a205a7670c601402de92665b8feb3da53f3f101\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"042255b04613d29500a28ec4adc5b5f4fcf6cbe78d55094480eba81f7af71619\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"970aa16af8b4bb2f6cec0a6e7c0015a57158e760681565309c998f71ce8db209\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"d1fd01793cdf475942193f7df4cab88271d0c25d0a0b97603d294f88a9a9e66e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"467c1cd50535115d1c93fa92dbedefdffda209c67635a7c9f2d4e4b7d1c40448\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"cc1e260081aaa11b1e64fdce5743900c523a102284329954b81fa9e5615fd5d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"7ce87578c845e67653744de960d7addbd2da0db09c8972b7959626f5e2ffd305\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"fdcbccabea6f5a084fba3916a03125c41dffb41b60390479203c79a6b13d0a11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a00fbe4ede3c0b38fe9870b558dc6cca1ac15f393e533ce225212342e5576\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"7130a2cd01d2c1a8eecf067d885e4657ef312b3d7f30b5e4eac4739658bad541\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a75d49d1e022c52a181927a608a19084dd86c326f0416c6b219c5b8fa23159aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"63b1c83beeb755b80d7178198f527193d510e225861b5c23cf970fb4ae687876\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4eebd9218d3bfd8903c1c37375ce84d954fcce6718e3f6e8b06be8ed99d1475\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"3c76bc3ea1b876509e55f18b7910426806fb5663135c747fb7d34b223d409623\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8a0865606771d7d25be6e06b0c7ebfa27cfd48b0ec71a10a8be703f4f7036e5d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"5083c8dc38df832bc037f302a468040f3b64d0d9eba3db62806992390cec1d77\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01f45d77b739548b875ad605c05b6fbf8c10e415162f56abccc239ca855caebb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"b5c4db66b62dce1fcf86c15563780bab7b6f0d451052a775ffa62194d2513d19\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b882686f61c2adb444c947f4b5d47a70e13204b10a7339dc8dadcd7190096540\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"64106d825ff3d5baa2abe1872fb6ccbac23e0ea641c6efa4c112682d60e19abc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f25f617f578fad9146a64cb7f062c228b7b2b2a449bdf9d5cf3e77ecc3cfde9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"527a933639ed5c7ae15b72ae0eff676ccc14d0abd22d16b8e3dd0d995c8c865c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af15043cf0d224fd39f286398c44f0a32129bd09df55e465f3528a48726d5603\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"74d7ee0abf71235eaf74d4056d4f5e3098ed9f1486865f1bd592d70850ff226e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"39e5af2b80d7b4f7f46a6b1f4ad79cb5106a53d8b7ba4b06da2fc3afbec9b647\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"53bf2dba0f403dbb3498feb5418147772fe20ce9e38550eda1d19c32a12f85ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e6c0d3e76bf0b4a5902f71821f0d8e5fe20b0f52652f172db60c3e3e7aa131\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"3a12ce4e9f0aa01bcd7ce4d7d4ee050d1919c183fb720fadcd0a3711b87bfbba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa431b3c2e5d50b746da30113d3e2b58611f629d9ea3e0efc23faffe4134c532\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"545122e07ad35afe6023ae9295f1a32127ee08e9b58766b5fe0610b4d989be33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"31f0143a60e13ea6745e7fb61bde4910bfe6acd14bb292dc0539b5f33d751f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"d45b1d00670fab41fe4c23d7fbdb9884306dde94843215fbbfd65a3cdb95fbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b289e3f1befd913bc5c27df0099b83939379105282e4bf360d74f9846054df84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"9039dde6e4107ae3eba9b18e0b483eff317c0a81f9dbd120da663535aa39f3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11c6d0a651652f81b1b93abb5a792126b56c88e30da1b18d815362f7b0ce56cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"8c0d0766432c32f4d1cb9cc2e54ca90e3333e0f672a08ec2e6034557027a73d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"449ca852af47a1b5a00efc7a8325cd4c05b2d460e01b696fcc011d14e0dab138\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"a57315f66093f4812f37dc0bf446d25423c0602dcdcc77576c94ee00e028b707\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63d30fa15f0c2b6c6f5fb22c3e04535e150fe07e2a1261ed59945ab2a4689711\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"91f6dc455b873524b4e6dd78ce85bc6951242eecb740adc87c5d8fc271c787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ad11e7c08fefebfdf94d7c2ce7ca200cc7799c40fea8b608f4117081898d4e2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"480f76c2d2396a3e8c16b7052cdda1531dce9083be3d6fd74f5017137508de08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-238db1/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-238db1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.894Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","resourceVersion":"130575","uid":"f4130945-c9d0-41b2-a0a6-41cb06e58f4e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:00.959Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":"2026-11-04T00:04:15Z","generation":10,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system","resourceVersion":"130677","uid":"4b4b4404-04ab-47e7-9b6a-155abf48ee04"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.066Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:39Z"}],"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","resourceVersion":"130737","uid":"3cadb7fb-34bb-4384-9baa-8b2e676dc6c0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.131Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","resourceVersion":"130702","uid":"8fea2396-6c61-4b0e-897e-a9ba0e797161"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.197Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","resourceVersion":"130573","uid":"6327ba77-94b6-4bbb-bc8a-f883ff4a36e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.262Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","resourceVersion":"130507","uid":"bdcf0562-2434-42f0-af93-c1f674e609f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.326Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","resourceVersion":"130651","uid":"c6683eb7-c87e-4ca2-82c1-0a26a13c0533"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.391Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","resourceVersion":"130513","uid":"b7d3a13b-e331-4e9f-a8d3-441262d963cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.455Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"}],"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","resourceVersion":"130374","uid":"ffdd41f3-82af-40be-bb9b-040eb397f7ce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.520Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:39Z"}],"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","resourceVersion":"130734","uid":"28feee4f-561a-4d63-9877-c5bb7ff4d572"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.591Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"16e6c0d3e76bf0b4a5902f71821f0d8e5fe20b0f52652f172db60c3e3e7aa131","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16e6c0d3e76bf0b4a5902f71821f0d8e5fe20b0f52652f172db60c3e3e7aa131"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"16e6c0d3e76bf0b4a5902f71821f0d8e5fe20b0f52652f172db60c3e3e7aa131\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:01.660Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:33Z"}],"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","resourceVersion":"130481","uid":"7fb18842-43f0-4afd-8bd4-52524a4d528d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:12:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:12:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.726Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:33Z"}],"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","resourceVersion":"130495","uid":"b33246e7-0352-41d5-aeda-06370c4f2104"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.792Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:39Z"}],"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","resourceVersion":"130720","uid":"0f705ecf-bf9f-42c5-923c-9bcdb55dd17c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:01.883Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f25f617f578fad9146a64cb7f062c228b7b2b2a449bdf9d5cf3e77ecc3cfde9d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f25f617f578fad9146a64cb7f062c228b7b2b2a449bdf9d5cf3e77ecc3cfde9d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f25f617f578fad9146a64cb7f062c228b7b2b2a449bdf9d5cf3e77ecc3cfde9d\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:01.948Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"}],"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","resourceVersion":"130385","uid":"f67432a6-d4fc-4453-9f0c-4f3e66d88a3d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.014Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":10,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:39Z"}],"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system","resourceVersion":"130716","uid":"2bfa8997-be7f-413c-adee-59c5f62ebf9a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.080Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","resourceVersion":"130598","uid":"4aeba8f0-1b34-4470-8415-8c1009b56810"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.146Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"}],"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","resourceVersion":"130424","uid":"c7ad77a2-8814-49ae-98b8-eea0745f2dea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.212Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","resourceVersion":"130639","uid":"41c72840-cfaa-4309-bd59-f64cab0d82da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","resourceVersion":"130649","uid":"4789dc1d-0b51-4a6f-b176-5aee3fa5eb1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.342Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","resourceVersion":"130688","uid":"5831c0c9-aa0b-49df-8c40-8305c69bb008"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.408Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:08Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"}],"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","resourceVersion":"130412","uid":"8d56271a-0715-4609-9700-c88e7b27e0fe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.475Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","resourceVersion":"130578","uid":"8f728668-caee-43f7-9724-558cf8503a70"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.540Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:35Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","resourceVersion":"130595","uid":"4cb69f08-179a-469d-b779-b7042c6da4e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.605Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","resourceVersion":"130582","uid":"7dd02dee-21f8-4e8f-8bcf-34f7283568b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.670Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","resourceVersion":"130568","uid":"5f83f408-3989-4587-955c-0d0e766e7b7c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.734Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":"2026-11-04T00:04:16Z","generation":10,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system","resourceVersion":"130559","uid":"62c7cacb-180e-4c90-b5d6-1c407e60ad8d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.801Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:40Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","resourceVersion":"130697","uid":"603b420f-4ff7-4b67-99f4-1e8d3f9cbcf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.866Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"}],"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","resourceVersion":"130402","uid":"f0ec2b4b-b236-463a-b2a5-84c3f9b4ade2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.931Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","resourceVersion":"130683","uid":"f659bddd-ccbc-4880-9d50-b3379269187a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:02.996Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:06:56Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","resourceVersion":"130554","uid":"e3004949-e35c-4e9b-a643-a948028f20b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.061Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","resourceVersion":"130622","uid":"4b310763-fcf4-40d4-b60d-82c26edb4d30"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.127Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:39Z"}],"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","resourceVersion":"130712","uid":"91fc9973-eae8-42fa-8bdc-767a7bbb76d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.193Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"}],"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","resourceVersion":"130369","uid":"436fe831-e0eb-4ef6-ba18-665342a6c7f4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.257Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:16Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:40Z"}],"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","resourceVersion":"130756","uid":"68046133-2e5e-4698-9fff-9ef40e5ac5d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:12:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:12:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.322Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","resourceVersion":"130693","uid":"f0b58eae-b5a7-4dc6-88bf-c1cb6e8b2bb6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.393Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5ad11e7c08fefebfdf94d7c2ce7ca200cc7799c40fea8b608f4117081898d4e2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5ad11e7c08fefebfdf94d7c2ce7ca200cc7799c40fea8b608f4117081898d4e2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5ad11e7c08fefebfdf94d7c2ce7ca200cc7799c40fea8b608f4117081898d4e2\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:03.458Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","resourceVersion":"130634","uid":"5c3c058c-07cf-4597-81f0-f0a0e6273d1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.523Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","resourceVersion":"130571","uid":"7290bf08-747f-4535-bdb4-b77f131ebf07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.588Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:51Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","resourceVersion":"130642","uid":"991fcc4c-9d1b-4b64-a94d-e09ed894da1f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.654Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:33Z"}],"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","resourceVersion":"130468","uid":"225cedac-fad9-4cca-aea2-ff0dda2db89d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.720Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:06Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"}],"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","resourceVersion":"130381","uid":"11563e4d-bd42-439e-953f-44d0dd5d96c5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.785Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","resourceVersion":"130647","uid":"5d17b531-e50a-4506-bef1-8eaa2cb8960f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:28:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.850Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:14Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"}],"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","resourceVersion":"130410","uid":"a2510f1b-a9b0-4a9c-bb15-c4621eb0422a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:12:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:12:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.916Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","resourceVersion":"130524","uid":"749db18a-efd0-45ab-9944-de1d056f97d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:03.981Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","resourceVersion":"130515","uid":"f8baf538-8b91-4b9d-93b4-3eb2ffb3dc44"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.046Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"}],"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","resourceVersion":"130378","uid":"b00ecfbf-ecc6-4817-b8c1-f0a5c174415a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.116Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"39e5af2b80d7b4f7f46a6b1f4ad79cb5106a53d8b7ba4b06da2fc3afbec9b647","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["39e5af2b80d7b4f7f46a6b1f4ad79cb5106a53d8b7ba4b06da2fc3afbec9b647"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"39e5af2b80d7b4f7f46a6b1f4ad79cb5106a53d8b7ba4b06da2fc3afbec9b647\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:04.181Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:39Z"}],"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","resourceVersion":"130730","uid":"0790ee5c-e21f-4d7b-a394-c30498d06200"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.247Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"}],"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","resourceVersion":"130421","uid":"0c2279be-f80c-43ce-aa74-c6c4374682cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.312Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:46Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","resourceVersion":"130527","uid":"680a2fbe-042b-4b0d-967b-f9c50d18d20c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.377Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:06:54Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","resourceVersion":"130580","uid":"0a533f9a-db7f-40ac-b074-215a942699d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:12:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:12:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.443Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:07Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","resourceVersion":"130587","uid":"aae853cf-0a4e-4aeb-a9d1-e210ae871fc6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.508Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"}],"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","resourceVersion":"130400","uid":"eab2a7f4-0d1f-4109-b660-70398295531e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:12:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:12:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.573Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:44Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","resourceVersion":"130630","uid":"f5aa5634-1eef-4c83-9de8-beb2bea42b54"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.638Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:15Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:39Z"}],"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","resourceVersion":"130726","uid":"745d7dea-a67a-4a7b-907d-673608c2af48"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.703Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:09Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","resourceVersion":"130521","uid":"1a9f71de-b6a8-4351-92e5-78cbcf89ab07"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.769Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:41Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","resourceVersion":"130585","uid":"c1d0e4d7-4c7d-4727-a7b1-d4a8f60ffa63"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.834Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:11Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:32Z"}],"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","resourceVersion":"130433","uid":"28091510-d93c-4962-92f3-527e9404502d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.900Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:50Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","resourceVersion":"130542","uid":"ce55126a-2797-4172-b44f-58d5fa61ef97"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:04.965Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","resourceVersion":"130691","uid":"5aecf4b8-cefb-471c-94ac-d3451688a75b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:05.035Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b882686f61c2adb444c947f4b5d47a70e13204b10a7339dc8dadcd7190096540","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b882686f61c2adb444c947f4b5d47a70e13204b10a7339dc8dadcd7190096540"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b882686f61c2adb444c947f4b5d47a70e13204b10a7339dc8dadcd7190096540\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:05.101Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:34Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:33Z"}],"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","resourceVersion":"130492","uid":"2e619d3e-8a68-4182-997f-3ea90cc450a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:05.174Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a75d49d1e022c52a181927a608a19084dd86c326f0416c6b219c5b8fa23159aa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a75d49d1e022c52a181927a608a19084dd86c326f0416c6b219c5b8fa23159aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a75d49d1e022c52a181927a608a19084dd86c326f0416c6b219c5b8fa23159aa\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:05.244Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8a0865606771d7d25be6e06b0c7ebfa27cfd48b0ec71a10a8be703f4f7036e5d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8a0865606771d7d25be6e06b0c7ebfa27cfd48b0ec71a10a8be703f4f7036e5d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8a0865606771d7d25be6e06b0c7ebfa27cfd48b0ec71a10a8be703f4f7036e5d\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:05.315Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"af15043cf0d224fd39f286398c44f0a32129bd09df55e465f3528a48726d5603","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["af15043cf0d224fd39f286398c44f0a32129bd09df55e465f3528a48726d5603"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"af15043cf0d224fd39f286398c44f0a32129bd09df55e465f3528a48726d5603\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:05.386Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"01f45d77b739548b875ad605c05b6fbf8c10e415162f56abccc239ca855caebb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01f45d77b739548b875ad605c05b6fbf8c10e415162f56abccc239ca855caebb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"01f45d77b739548b875ad605c05b6fbf8c10e415162f56abccc239ca855caebb\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:05.457Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f4eebd9218d3bfd8903c1c37375ce84d954fcce6718e3f6e8b06be8ed99d1475","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f4eebd9218d3bfd8903c1c37375ce84d954fcce6718e3f6e8b06be8ed99d1475"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f4eebd9218d3bfd8903c1c37375ce84d954fcce6718e3f6e8b06be8ed99d1475\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:05.522Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:42Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:39Z"}],"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","resourceVersion":"130725","uid":"97d1e99e-db75-43ed-8e5c-d1ef7cbfcc8a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:05.588Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:12Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","resourceVersion":"130628","uid":"ea93d085-96bb-46ba-9258-16618433a0f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:05.654Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:32Z"}],"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","resourceVersion":"130451","uid":"f4ad64b4-da27-4c73-bd47-df0058b599ab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:05.720Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","resourceVersion":"130707","uid":"591b2c08-f8dd-44ee-85ae-148c50d87e9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:05.786Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":10,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"}],"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system","resourceVersion":"130407","uid":"94e84cfc-05a1-4a7a-9c7c-93cb02e3fb46"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:05.851Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","resourceVersion":"130551","uid":"46cd51d3-5f06-4d20-b71e-1f0b4db592de"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:05.917Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"}],"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","resourceVersion":"130418","uid":"d7bcc5f6-9218-414f-b4a3-f8e8f42a7ea6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:05.982Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","resourceVersion":"130709","uid":"5259cba1-fb24-4243-b768-481e6b8a2f74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.049Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:48Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","resourceVersion":"130545","uid":"6a0aa075-2a97-4b6b-8291-ea7177f180e8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:12:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:12:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.114Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:39Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","resourceVersion":"130530","uid":"7ee97d41-8f87-4354-84af-b7e57b6b4bd3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:21:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.180Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"}],"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","resourceVersion":"130404","uid":"03510a5d-12ad-47ac-8aa3-861a3474a6ef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:12:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:12:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.250Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"40145d9c1f3408fabe2b0b3c033a1ef52e42d748133ef4d25bb08352ca069a2d\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:06.315Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:30Z"}],"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","resourceVersion":"130367","uid":"81514f4e-cb8f-4022-b596-09cf37bd31d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.380Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","resourceVersion":"130699","uid":"bed19aa4-37ac-48f3-890d-4584e37ea205"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.445Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","resourceVersion":"130517","uid":"05c7120a-82ee-4fee-846a-4e3841beb2e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.510Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","resourceVersion":"130610","uid":"efe4bf6b-05b6-403d-802c-6d695d0e65d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.575Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":10,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system","resourceVersion":"130603","uid":"a0647f68-e21f-4ae8-a007-876e4afcedc1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:04:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.640Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:07:13Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:33Z"}],"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","resourceVersion":"130488","uid":"1ed933c4-6946-4544-8f9c-f46f7e0d062a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:20:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.706Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:06:57Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","resourceVersion":"130672","uid":"a734419e-fb72-4d8c-8726-0cf49c79903b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.771Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","resourceVersion":"130549","uid":"e8d2a952-464c-46fe-a26d-8065101e10ba"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.836Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:52Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","resourceVersion":"130605","uid":"a3cd9798-35c5-4e84-8035-49d9651e7466"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.900Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:35Z"}],"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","resourceVersion":"130555","uid":"5294372c-e0b1-4ea7-952e-b2054adcabed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:00:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:06.967Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:07:36Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:29Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:30Z"}],"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","resourceVersion":"130371","uid":"2ebc719a-5efd-4f44-8a8b-a20427dd08a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:12:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:12:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.032Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:37Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","resourceVersion":"130617","uid":"6e833789-6bea-4b55-9954-107673397cb1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.097Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:45Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","resourceVersion":"130537","uid":"a3a8f190-0b70-4fce-975e-ca63be466540"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:01:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.162Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:10Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:31Z"}],"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","resourceVersion":"130416","uid":"c8f8cd08-2a0f-4e20-a30b-5e6ca75dc31e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":"2026-11-04T00:04:17Z","generation":10,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system","resourceVersion":"130667","uid":"da925041-7e60-4173-a86b-d5b45301b805"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.293Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:49Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:39Z"}],"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","resourceVersion":"130723","uid":"d7362fcf-6346-4177-8a82-a502664af493"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.363Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-238db1/rate-test-model-238db1-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fa431b3c2e5d50b746da30113d3e2b58611f629d9ea3e0efc23faffe4134c532","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fa431b3c2e5d50b746da30113d3e2b58611f629d9ea3e0efc23faffe4134c532"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-238db1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fa431b3c2e5d50b746da30113d3e2b58611f629d9ea3e0efc23faffe4134c532\" already exists"}
{"level":"error","ts":"2026-11-04T01:16:07.428Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:38Z"}],"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","resourceVersion":"130675","uid":"9ab9be04-60a7-4454-ba4d-ca03f4b8f174"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.493Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","resourceVersion":"130505","uid":"b1c16000-3633-41db-a343-82b238efb39f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.559Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:07:38Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","resourceVersion":"130663","uid":"4df3ee09-24f5-46d6-af83-5d91cc9b6a3f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:07:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.624Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","resourceVersion":"130625","uid":"544dcd98-b37d-4269-af23-0d4485bbca38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.688Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:07:47Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","resourceVersion":"130654","uid":"9d1c31ae-1c67-4bcf-92ea-4206077e7438"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:08:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.753Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:07:53Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:34Z"}],"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","resourceVersion":"130534","uid":"4789cda5-d34c-48f9-9bdd-b029016fb3a4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:09:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:09:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.818Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:06:55Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:36Z"}],"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","resourceVersion":"130591","uid":"0d8715b8-d57a-454f-a76b-daeba49ae132"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:06:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:07.884Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:07:43Z","generation":9,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:12:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:12:37Z"}],"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","resourceVersion":"130657","uid":"2e63465b-6b28-4996-9d9f-439009fe7879"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:08:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:08:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:08.183Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:08.485Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-238db1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-238db1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:09.241Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-238db1-kserve-route","namespace":"ai-tenant-e2e-shared-a-w2-238db1","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"rate-test-model-238db1-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:16:17.729Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","Limitador","ConfigMap","EnvoyFilter","HTTPRoute","Gateway","AuthPolicy"],"eventTypes":{"create":13,"update":129}}
{"level":"info","ts":"2026-11-04T01:16:18.167Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:20.632Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:16:20.828Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:16:20.828Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:16:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","reconcileID":"c1541024-04b1-4544-945c-bbc1f3f8b174","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:16:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:16:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:16:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:16:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:16:23Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-04T01:16:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:16:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","reconcileID":"fc2b08c1-9238-4d00-bf4c-cad696bbfa1e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:16:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:16:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:16:24.615Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:16:24.615Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:24.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:16:24.622Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:16:24.639Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:16:24.640Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:24.640Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:16:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:16:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:16:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:16:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","reconcileID":"6a30bf84-b981-4106-9356-9f6f643c78f6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:16:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:16:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:16:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:16:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:16:25Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:16:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:16:34.406Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:34.406Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:16:34.878Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-923a2f12","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-923a2f12\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:16:35.137Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-ad3cbc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:16:42.804Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","AuthPolicy","Limitador","HTTPRoute","Kuadrant","Gateway","ConfigMap"],"eventTypes":{"create":4,"update":130}}
{"level":"info","ts":"2026-11-04T01:16:43.206Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:43.214Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:46.433Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:16:46.661Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:16:46.744Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:16:46.926Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:16:46.926Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:16:50.523Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:16:50.527Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:50.534Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:16:50.535Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:16:50.538Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:50.538Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:16:50.657Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:16:54.323Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:16:54.323Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:17:07.313Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","EnvoyFilter","AuthPolicy","Limitador","ConfigMap","HTTPRoute","Gateway"],"eventTypes":{"create":21,"update":31}}
{"level":"info","ts":"2026-11-04T01:17:07.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","reconcileID":"992a6c78-6d79-4acd-901b-ecd40e039293","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:17:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","event":"CREATE"}
{"level":"info","ts":"2026-11-04T01:17:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:17:10.459Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:17:10.632Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:17:10.632Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:17:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-04T01:17:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-04T01:17:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:17:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","reconcileID":"a59fc667-4dde-4117-b67d-9f9af980b9d2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:17:10Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","reconcileID":"a59fc667-4dde-4117-b67d-9f9af980b9d2"}
{"level":"error","ts":"2026-11-04T01:17:10Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","reconcileID":"a59fc667-4dde-4117-b67d-9f9af980b9d2","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-inf-b-047f21\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:17:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","reconcileID":"87fe06bc-4a8e-4474-83fd-4121cc0c0db2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:17:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:17:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:17:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:17:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:17:12Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:17:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:17:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-04T01:17:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:17:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-04T01:17:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-04T01:17:13Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-04T01:17:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:17:14.727Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:17:14.736Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:14.749Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:17:14.754Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:17:14.762Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:14.762Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:17:14.851Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:17:14.851Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:17:18.333Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:18.333Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:17:18.423Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-047f21","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-047f21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:17:20.066Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-04T01:17:26.522Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:17:26.531Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:26.537Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:26.537Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:17:26.538Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:17:26.538Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:17:26.642Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:17:26.642Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:17:26.651Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"11bdd2b8a00909c0f187ca67d41d78d206d037a00bec874b5f217240acddcff8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["11bdd2b8a00909c0f187ca67d41d78d206d037a00bec874b5f217240acddcff8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"11bdd2b8a00909c0f187ca67d41d78d206d037a00bec874b5f217240acddcff8\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:26.721Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6c8126f45a52bcd987e939c23f9da9f433fd35d9c3e5a87e69f5c0830a73ac83","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6c8126f45a52bcd987e939c23f9da9f433fd35d9c3e5a87e69f5c0830a73ac83"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6c8126f45a52bcd987e939c23f9da9f433fd35d9c3e5a87e69f5c0830a73ac83\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:26.830Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"73e29825258c01cda83047eeec9c43a2d5dc72122f0a5953b06ebf240dc25577","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["73e29825258c01cda83047eeec9c43a2d5dc72122f0a5953b06ebf240dc25577"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"73e29825258c01cda83047eeec9c43a2d5dc72122f0a5953b06ebf240dc25577\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:26.930Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:27.006Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b2a036eef771250380a27390d914c74936b69191171b88b607f8b1cf82db8b4d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b2a036eef771250380a27390d914c74936b69191171b88b607f8b1cf82db8b4d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b2a036eef771250380a27390d914c74936b69191171b88b607f8b1cf82db8b4d\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:27.081Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bee025f2e728680faa3c9ef656ac14a42b6f3c5c6f5a86558ced027f957a8e2d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bee025f2e728680faa3c9ef656ac14a42b6f3c5c6f5a86558ced027f957a8e2d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bee025f2e728680faa3c9ef656ac14a42b6f3c5c6f5a86558ced027f957a8e2d\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:27.152Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"68da568b2e0795d31ab1efb5836b88d26dad0f19a22f64fc3b1561586a9e31d8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68da568b2e0795d31ab1efb5836b88d26dad0f19a22f64fc3b1561586a9e31d8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"68da568b2e0795d31ab1efb5836b88d26dad0f19a22f64fc3b1561586a9e31d8\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:27.224Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ac94984a86315b01b53eb979b91d6a935d4a0595ba64c3e704ca668c2eebd1a0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ac94984a86315b01b53eb979b91d6a935d4a0595ba64c3e704ca668c2eebd1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ac94984a86315b01b53eb979b91d6a935d4a0595ba64c3e704ca668c2eebd1a0\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:27.299Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9c3b4ee8c6ae1d51227eb4677de89ed4e77374a9c911529b49097da99db420f1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9c3b4ee8c6ae1d51227eb4677de89ed4e77374a9c911529b49097da99db420f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9c3b4ee8c6ae1d51227eb4677de89ed4e77374a9c911529b49097da99db420f1\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:27.369Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e2e53c4baab97dcbd1f516cdebfbe4b9d11e490edb40fc490159a76795739a0a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e2e53c4baab97dcbd1f516cdebfbe4b9d11e490edb40fc490159a76795739a0a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e2e53c4baab97dcbd1f516cdebfbe4b9d11e490edb40fc490159a76795739a0a\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:27.442Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9d51b49a426f771721c7eefd4e5b1a3caf7b1d247837181e4bc089c073ab4efa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9d51b49a426f771721c7eefd4e5b1a3caf7b1d247837181e4bc089c073ab4efa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9d51b49a426f771721c7eefd4e5b1a3caf7b1d247837181e4bc089c073ab4efa\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:27.523Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ba889df5f2f16479ed4a037206d97ef3bdbf1c98c313620c7dae310091bd0461","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ba889df5f2f16479ed4a037206d97ef3bdbf1c98c313620c7dae310091bd0461"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ba889df5f2f16479ed4a037206d97ef3bdbf1c98c313620c7dae310091bd0461\" already exists"}
{"level":"error","ts":"2026-11-04T01:17:28.016Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-516871","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:58Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59262430-a65d-4fb9-8082-a5ebbf86b6f6\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:53:13Z"}],"name":"kuadrant-e2e-shared-b-w2-516871","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-516871","uid":"59262430-a65d-4fb9-8082-a5ebbf86b6f6"}],"resourceVersion":"101486","uid":"f7839c9e-8ba0-49f2-b1b3-fba72e0e34b1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"9341334deb86e1208825acd707354bae6777e9e3a4a9a3485fb539a3a382ab2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"c79bc2cd4ac93976282ab96cf9b75a411fbb1917dbd9aae0f3476d7bd19e78a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"0b0ed4fb7995005c4cc0d5ca7e414bb9f8e9c0a70f7d699ae5da03ab239ae257\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"41facbe8b7db7d88a22100b69cbc526242da974439fc726ee417b6d703def3f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"ca005267f207bdf492e2b390760e781e38168c6a773d4d5d73c15e25896350a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"a7a4c68cad8b0020684e62605ec4c1fe79e3b4d6e15ecd868a24998ab43381da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"661813093bc81a3612217a17d2bfe68e10bdef57b3f6c86b36de77610f16e64c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"caef75778c8829b8a1ce356cccf9ef9db99ae37266bf42513bf61ba0e723c71c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"b0bdf1559fb724e46b834693961ac80012ba18b84f1f7e761830354d69b6c20f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ba889df5f2f16479ed4a037206d97ef3bdbf1c98c313620c7dae310091bd0461\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"27076f84093b58d128a0df7300fcdc9c5d0c70e9a3ed9dc582f2afafcbb10418\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73e29825258c01cda83047eeec9c43a2d5dc72122f0a5953b06ebf240dc25577\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"809d465c4078d5e7d05d0181101e1d927b33fb8a05a16c9cd22f4fc5e693c7e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d51b49a426f771721c7eefd4e5b1a3caf7b1d247837181e4bc089c073ab4efa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"eff843e30cb72d79fc66857d109d36d3ae9b0f157785bb4b32af8fafcc0b42ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac94984a86315b01b53eb979b91d6a935d4a0595ba64c3e704ca668c2eebd1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"94f92c74b4fe0f148af8ae85355ef3ff677c1fb7216a1615a16aa6f1e9f5d84a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c3b4ee8c6ae1d51227eb4677de89ed4e77374a9c911529b49097da99db420f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"7472ab8abce66c7b8d69622e4c802f96321d96ae9c53ee487f3f80afe8da41ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68da568b2e0795d31ab1efb5836b88d26dad0f19a22f64fc3b1561586a9e31d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6664a4c2e019c2d31f85421d86baa4fac4c1041a00ae3721bb0b57a8ccbb2f03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b2a036eef771250380a27390d914c74936b69191171b88b607f8b1cf82db8b4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6fe7808d3ab1c5b89345473c0506b3a74b3d1a8735a3a607d065250640b1e086\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bee025f2e728680faa3c9ef656ac14a42b6f3c5c6f5a86558ced027f957a8e2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"06a42d84312769bcee03b258cc4728b6ce013c9a1216dd27757277322728fe3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e2e53c4baab97dcbd1f516cdebfbe4b9d11e490edb40fc490159a76795739a0a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"43d56e7ffacafc951af7e5e172449a6daa8a2e59cd7c60b7eb6ee42e27b86a25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c8126f45a52bcd987e939c23f9da9f433fd35d9c3e5a87e69f5c0830a73ac83\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"7af5bce160eadd58fa4dabf3bcc1733968ee57446e916ad3e1b3d89c3eb6df6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6118ee007d06753619cdd3723e5f364a3646a3c9d99cd0e248a2b041cedc688e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"ae0c5d6228fd93a9b5aa81cf9c846a9343adbd4f82f7085a13f27f7d910fe0c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"93f6801119535020e051e319ff1814709e08eba59d41d11da398d6675db1d33b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"c43b20454038dbfa463db22fa3ec806267111d0d7471710a880d546f9c04b08c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6a5ce3b5e4931a7f21c9b99482f16a36f46eb3341d6754ac80a7a492496aaca3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11bdd2b8a00909c0f187ca67d41d78d206d037a00bec874b5f217240acddcff8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"97c85a3e7546884e5351c01f98f7edc7e3cd479aa9f5d4a86bb7d831c57d42ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-516871"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:17:28.643Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-516871-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-516871-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:17:28.789Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-923a2f12-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-923a2f12-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:17:29.245Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-ad3cbc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-ad3cbc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:17:29.581Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-923a2f12","namespace":"openshift-ingress","uid":"d236a6c9-3452-470d-9eb7-20546d4206ad","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-923a2f12\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:17:29.888Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:29.888Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:17:30.219Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-516871-kserve-route","namespace":"ai-tenant-e2e-shared-b-w2-516871","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"rate-test-model-516871-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:17:30.504Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-047f21","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-047f21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:17:38.790Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","EnvoyFilter","AuthPolicy","TokenRateLimitPolicy","Kuadrant","ConfigMap","Limitador","Gateway"],"eventTypes":{"create":15,"update":10}}
{"level":"info","ts":"2026-11-04T01:17:39.201Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:39.221Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:43.236Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:17:43.248Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:17:43.248Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:17:43.531Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:17:43.531Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:17:47.443Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:17:47.449Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:47.457Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:17:47.514Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:17:47.521Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:47.521Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:17:47.602Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:17:49.921Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-238db1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-238db1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:17:51.036Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:17:51.036Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:17:51.893Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:18:00.387Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","EnvoyFilter","Gateway","AuthConfig","ConfigMap","HTTPRoute","Limitador","TokenRateLimitPolicy"],"eventTypes":{"create":10,"update":9}}
{"level":"info","ts":"2026-11-04T01:18:00.753Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:04.570Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:18:04.720Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:18:04.720Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:08.960Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:18:08.962Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:09.018Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:18:09.033Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:09.033Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:09.035Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:18:09.077Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:18:09.077Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:13.269Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:13.269Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:22.509Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","HTTPRoute","TokenRateLimitPolicy","Limitador","ConfigMap","AuthPolicy","Gateway"],"eventTypes":{"create":13,"update":27}}
{"level":"info","ts":"2026-11-04T01:18:22.912Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:25.541Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:18:25.814Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:18:25.814Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:30.661Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:18:30.666Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:30.744Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:18:30.746Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:18:30.813Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:30.813Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:30.914Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:34.404Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:34.404Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:43.451Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","EnvoyFilter","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"create":12,"update":7}}
{"level":"info","ts":"2026-11-04T01:18:43.853Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:46.232Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:18:46.528Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:18:46.528Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:51.055Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:18:51.055Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:51.067Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:18:51.067Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:18:51.114Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:18:51.131Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:51.131Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:18:53.236Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-516871-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-516871-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:18:54.527Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:18:54.527Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:18:54.596Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-567653","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-567653\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:19:03.531Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Limitador","Gateway","HTTPRoute","ConfigMap"],"eventTypes":{"create":1,"update":28}}
{"level":"info","ts":"2026-11-04T01:19:03.885Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:19:07.259Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:19:07.432Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:19:07.433Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:19:12.033Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:19:12.038Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:19:12.046Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:19:12.046Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:19:12.048Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:19:12.048Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:19:12.248Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:19:17.864Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:19:17.865Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:19:19.698Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T01:19:26.753Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:19:26.766Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:19:26.766Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:19:26.876Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:26.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T01:16:52Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:52Z"}],"name":"fea0207530cb2c23c7160f6f6c4e418b33c12941232cf555b00d867472f65d48","namespace":"kuadrant-system","resourceVersion":"137163","uid":"824eb80d-4262-4262-9cd3-47464911fbaf"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fea0207530cb2c23c7160f6f6c4e418b33c12941232cf555b00d867472f65d48"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fea0207530cb2c23c7160f6f6c4e418b33c12941232cf555b00d867472f65d48"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fea0207530cb2c23c7160f6f6c4e418b33c12941232cf555b00d867472f65d48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.026Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-1"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:50Z"}],"name":"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c","namespace":"kuadrant-system","resourceVersion":"100936","uid":"8dc082e3-43be-41d6-ac9d-4f08d7510c3c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.113Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:16Z"}],"name":"bee025f2e728680faa3c9ef656ac14a42b6f3c5c6f5a86558ced027f957a8e2d","namespace":"kuadrant-system","resourceVersion":"137704","uid":"def86b65-17f6-4bbc-9b07-44ed90c68a9f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bee025f2e728680faa3c9ef656ac14a42b6f3c5c6f5a86558ced027f957a8e2d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bee025f2e728680faa3c9ef656ac14a42b6f3c5c6f5a86558ced027f957a8e2d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bee025f2e728680faa3c9ef656ac14a42b6f3c5c6f5a86558ced027f957a8e2d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.181Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-2"},"creationTimestamp":"2026-11-04T00:42:32Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:14Z"}],"name":"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980","namespace":"kuadrant-system","resourceVersion":"99624","uid":"0cb723de-253f-4012-a6d3-88c86c8e4f2c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.280Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-2"},"creationTimestamp":"2026-11-04T00:44:59Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:52Z"}],"name":"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed","namespace":"kuadrant-system","resourceVersion":"101076","uid":"5256cd72-5c6e-4d97-b26a-ea420a9b412e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.346Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"}],"name":"ba889df5f2f16479ed4a037206d97ef3bdbf1c98c313620c7dae310091bd0461","namespace":"kuadrant-system","resourceVersion":"137698","uid":"7b9c7404-ac81-47d3-b15d-7ed9ef701a5f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ba889df5f2f16479ed4a037206d97ef3bdbf1c98c313620c7dae310091bd0461"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ba889df5f2f16479ed4a037206d97ef3bdbf1c98c313620c7dae310091bd0461"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ba889df5f2f16479ed4a037206d97ef3bdbf1c98c313620c7dae310091bd0461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.413Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:16:51Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:51Z"}],"name":"a8a1a2ef7307594be5b839ab2b8e52376f53c0aede134ac0f2b06e097ed15fdd","namespace":"kuadrant-system","resourceVersion":"137119","uid":"f28ed89e-06a4-4f70-8e5b-76a5c7c7705f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8a1a2ef7307594be5b839ab2b8e52376f53c0aede134ac0f2b06e097ed15fdd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8a1a2ef7307594be5b839ab2b8e52376f53c0aede134ac0f2b06e097ed15fdd"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8a1a2ef7307594be5b839ab2b8e52376f53c0aede134ac0f2b06e097ed15fdd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.479Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"}],"name":"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e","namespace":"kuadrant-system","resourceVersion":"137703","uid":"c609cc28-eade-4168-9ed4-1de2084a931a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.545Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T01:17:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"}],"name":"68da568b2e0795d31ab1efb5836b88d26dad0f19a22f64fc3b1561586a9e31d8","namespace":"kuadrant-system","resourceVersion":"137672","uid":"08578ab6-c95a-42ee-bda8-59cb4e144e2c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68da568b2e0795d31ab1efb5836b88d26dad0f19a22f64fc3b1561586a9e31d8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68da568b2e0795d31ab1efb5836b88d26dad0f19a22f64fc3b1561586a9e31d8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68da568b2e0795d31ab1efb5836b88d26dad0f19a22f64fc3b1561586a9e31d8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.614Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T01:16:50Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:51Z"}],"name":"3feb0a16e30f084b3e838206e754c2e0d3aa634927efabf4ba030ccffb4c0586","namespace":"kuadrant-system","resourceVersion":"137102","uid":"30bc1616-5d70-4462-8c2c-50351acea2c5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3feb0a16e30f084b3e838206e754c2e0d3aa634927efabf4ba030ccffb4c0586"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3feb0a16e30f084b3e838206e754c2e0d3aa634927efabf4ba030ccffb4c0586"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3feb0a16e30f084b3e838206e754c2e0d3aa634927efabf4ba030ccffb4c0586\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.684Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:27.727Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-567653","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:14:46Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:14:46Z"}],"name":"kuadrant-e2e-inf-a-567653","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-567653","uid":"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4"}],"resourceVersion":"133173","uid":"88d15361-4538-4067-a295-10eac23868b7"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"7a464ef9ab6a4e807ef6453fd2cca0bd0dcbd605c836b6a068a16ff289505d5a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"cd5092683273efc9431833eedef34efcb62a5c43463dcce3dc9fee55aefa712a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"e7fe8a923fd511b559bb25ab3cf3ea4e9bf138ae8d76edafb05b7b5c40bd6d03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"4188fb0dc9ece2a5759c276f2daeffc7e035159b820ed2acded71ad02ca02161\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"2d3f1d7d82d384117ff72d69e4b1d29343ce9951a2f78bdd15261ab2cd32f4b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"5b09c64ba50c301b74e83debe623de502a5f5d0c19fb68f4a990fc93502e0597\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"a39e74ddab347d8ea71b7410ff253c056b462ef3653d578b1c19ae20ec1b7c1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"e5e65a84864d98c65f00b26f4b5242a8f770672db5d962600cd902e1e256773b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"0b1a56521a0c26caf235871aedb602b5e8ec34d357cfb5bb798739db3047de74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"77b558817b8449256a10bef565a9f198782f74ed89b684f15ee32711fc4024a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"8b520257c496ea4fd6dc57e8aafd96a5d4f480d07214b9eeac46c2a0bf6c1182\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"3892e12b6d49759143234e20e4266c21b56ac13e325f28042ed865f8165dc673\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"4a4982ac57138aa21be8768053ea4b0c87eb19d4c2208497b48311e0c64d14fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"59843c32c3a7620b0e11b75bf3e41573684a47a7eced56b076841142b77365eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"02ae347d6cfde776ed074d8d34839bbdbd9abf37ec62a9fee05d88a9d480f38d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"abdbb2b6dbf72730a51659bb8d10df4db4b3800b156128e26017899aa817b420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"5f241107e79a1d2ae1b9667fbaf3d45cf23ba11cc11a681259bd7fcb8fe7e0b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"ced0afc84cfa49bcec48eb13dba447cf0b029476d7e527e2199dcdd94d7c67c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"08d1152a95c976913421b236410d0074ae88a050c4be81772dff1cc8d06c13a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"5eced2745940640ce546e289f8794270a15642dd276b93577c3de730b4c6382f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"aaef5613c6cb1087de33139be37421ba4d698b456be39014dd402b24437f09a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"64bd01c13d26bc3e567f123ecf2f8183f58e588bb3c05cbf5bc07047e08343e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"6d4943470a0993df71ccd3c155e0dc41fccb2eb62830f9abeb2b635e3f12329f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"89b769ee6e98227227bd288da26910ca294c4e62a32888de7fe4577fb38a24b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"9e257201f64bdb599c9b19f0e840bc05fa9f25afc4e67fd3c09e6221ee71ba8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-567653"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-567653\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.750Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T01:16:51Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:51Z"}],"name":"5a29300ac895d44aaffa06bff6601b0d7ca713ecc3c59f292293e4a391c7bb46","namespace":"kuadrant-system","resourceVersion":"137122","uid":"f243cecf-e8f0-425b-b1f5-47fe59cc6c0f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5a29300ac895d44aaffa06bff6601b0d7ca713ecc3c59f292293e4a391c7bb46"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5a29300ac895d44aaffa06bff6601b0d7ca713ecc3c59f292293e4a391c7bb46"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5a29300ac895d44aaffa06bff6601b0d7ca713ecc3c59f292293e4a391c7bb46\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.818Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T01:16:50Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:51Z"}],"name":"89ca25033a5c3ccedd6f93e26e934793a06bec170890a586a8ece7a6a91dab27","namespace":"kuadrant-system","resourceVersion":"137091","uid":"ad291f88-b037-437b-8913-1a8c3ff1002d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["89ca25033a5c3ccedd6f93e26e934793a06bec170890a586a8ece7a6a91dab27"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["89ca25033a5c3ccedd6f93e26e934793a06bec170890a586a8ece7a6a91dab27"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"89ca25033a5c3ccedd6f93e26e934793a06bec170890a586a8ece7a6a91dab27\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.885Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"}],"name":"11bdd2b8a00909c0f187ca67d41d78d206d037a00bec874b5f217240acddcff8","namespace":"kuadrant-system","resourceVersion":"137692","uid":"ae86b8be-e90a-48ea-942b-0538efd66450"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["11bdd2b8a00909c0f187ca67d41d78d206d037a00bec874b5f217240acddcff8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["11bdd2b8a00909c0f187ca67d41d78d206d037a00bec874b5f217240acddcff8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"11bdd2b8a00909c0f187ca67d41d78d206d037a00bec874b5f217240acddcff8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:27.956Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:28.023Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"}],"name":"9c3b4ee8c6ae1d51227eb4677de89ed4e77374a9c911529b49097da99db420f1","namespace":"kuadrant-system","resourceVersion":"137676","uid":"a2cb7936-d74a-4649-a0d4-5020a82382ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9c3b4ee8c6ae1d51227eb4677de89ed4e77374a9c911529b49097da99db420f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9c3b4ee8c6ae1d51227eb4677de89ed4e77374a9c911529b49097da99db420f1"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9c3b4ee8c6ae1d51227eb4677de89ed4e77374a9c911529b49097da99db420f1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.089Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T01:16:51Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:51Z"}],"name":"85e855fcbbc28ab54202a13b642bbb677e84cca41a6be3c9c8c34ffeecbf498c","namespace":"kuadrant-system","resourceVersion":"137104","uid":"54aae6a0-3881-4bc8-8e83-dfe7d03668af"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["85e855fcbbc28ab54202a13b642bbb677e84cca41a6be3c9c8c34ffeecbf498c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["85e855fcbbc28ab54202a13b642bbb677e84cca41a6be3c9c8c34ffeecbf498c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"85e855fcbbc28ab54202a13b642bbb677e84cca41a6be3c9c8c34ffeecbf498c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.154Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-4"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:52Z"}],"name":"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942","namespace":"kuadrant-system","resourceVersion":"101071","uid":"2ee84eee-e98e-4bb2-9380-029fd2dc2594"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:45:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.224Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T01:16:51Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:51Z"}],"name":"e507dcad01174c518e1517f33216112d236677ce5e65f7a75ab9708fe267a09c","namespace":"kuadrant-system","resourceVersion":"137126","uid":"47156371-68d5-4902-af3c-a485efdfd2e1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e507dcad01174c518e1517f33216112d236677ce5e65f7a75ab9708fe267a09c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e507dcad01174c518e1517f33216112d236677ce5e65f7a75ab9708fe267a09c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e507dcad01174c518e1517f33216112d236677ce5e65f7a75ab9708fe267a09c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.299Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:28.366Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T01:16:51Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:51Z"}],"name":"1654f8b4b79bdfda4497c1d19df70d990bc6595d7ebab424c748106829bf0fb5","namespace":"kuadrant-system","resourceVersion":"137111","uid":"88dd2167-2010-4a13-8fe8-6ecb66ca5fbf"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1654f8b4b79bdfda4497c1d19df70d990bc6595d7ebab424c748106829bf0fb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1654f8b4b79bdfda4497c1d19df70d990bc6595d7ebab424c748106829bf0fb5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1654f8b4b79bdfda4497c1d19df70d990bc6595d7ebab424c748106829bf0fb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.431Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T01:16:51Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:52Z"}],"name":"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c","namespace":"kuadrant-system","resourceVersion":"137136","uid":"7f438be2-4aef-4df7-9cfa-3f35a95371ad"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.502Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:28.575Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:28.642Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:16Z"}],"name":"e2e53c4baab97dcbd1f516cdebfbe4b9d11e490edb40fc490159a76795739a0a","namespace":"kuadrant-system","resourceVersion":"137715","uid":"07792d3f-82a2-4b53-aaaa-323f04f8e053"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e2e53c4baab97dcbd1f516cdebfbe4b9d11e490edb40fc490159a76795739a0a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e2e53c4baab97dcbd1f516cdebfbe4b9d11e490edb40fc490159a76795739a0a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e2e53c4baab97dcbd1f516cdebfbe4b9d11e490edb40fc490159a76795739a0a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.708Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"}],"name":"6c8126f45a52bcd987e939c23f9da9f433fd35d9c3e5a87e69f5c0830a73ac83","namespace":"kuadrant-system","resourceVersion":"137690","uid":"1b5af9b6-8f90-42c0-9fc6-c716555ab7b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6c8126f45a52bcd987e939c23f9da9f433fd35d9c3e5a87e69f5c0830a73ac83"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6c8126f45a52bcd987e939c23f9da9f433fd35d9c3e5a87e69f5c0830a73ac83"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6c8126f45a52bcd987e939c23f9da9f433fd35d9c3e5a87e69f5c0830a73ac83\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.783Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T01:16:51Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:51Z"}],"name":"ce83233ea29dce22f30dd59797c1b10d9dff4c9d10b358802da3553405d4a8ba","namespace":"kuadrant-system","resourceVersion":"137131","uid":"6cfaa419-cee9-41b5-90a5-f03730af4cb8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce83233ea29dce22f30dd59797c1b10d9dff4c9d10b358802da3553405d4a8ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce83233ea29dce22f30dd59797c1b10d9dff4c9d10b358802da3553405d4a8ba"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce83233ea29dce22f30dd59797c1b10d9dff4c9d10b358802da3553405d4a8ba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.849Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-1"},"creationTimestamp":"2026-11-04T00:42:32Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:11Z"}],"name":"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7","namespace":"kuadrant-system","resourceVersion":"99505","uid":"7d2957c2-c3f9-424f-9b1f-7c14f1b25dda"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:28.921Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:28.986Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-3"},"creationTimestamp":"2026-11-04T00:42:33Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:12Z"}],"name":"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387","namespace":"kuadrant-system","resourceVersion":"99535","uid":"fb5c1b53-a25a-4ffc-8db8-8da0c4643c02"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.052Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-6"},"creationTimestamp":"2026-11-04T00:42:33Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:13Z"}],"name":"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a","namespace":"kuadrant-system","resourceVersion":"99582","uid":"2642d7a5-af27-4b58-823d-2ae27a975cef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.123Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:29.194Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:29.262Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-5"},"creationTimestamp":"2026-11-04T00:42:33Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:12Z"}],"name":"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a","namespace":"kuadrant-system","resourceVersion":"99533","uid":"9038beae-ade1-4bcf-80fe-8adee6066f06"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:42:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.330Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-5"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:49Z"}],"name":"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f","namespace":"kuadrant-system","resourceVersion":"100898","uid":"799e8ea1-04cb-4248-ad22-77934184f53c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.398Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"}],"name":"ac94984a86315b01b53eb979b91d6a935d4a0595ba64c3e704ca668c2eebd1a0","namespace":"kuadrant-system","resourceVersion":"137681","uid":"67fec27c-28ec-4888-a193-58bede5b6ac6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ac94984a86315b01b53eb979b91d6a935d4a0595ba64c3e704ca668c2eebd1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ac94984a86315b01b53eb979b91d6a935d4a0595ba64c3e704ca668c2eebd1a0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ac94984a86315b01b53eb979b91d6a935d4a0595ba64c3e704ca668c2eebd1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.463Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"}],"name":"b2a036eef771250380a27390d914c74936b69191171b88b607f8b1cf82db8b4d","namespace":"kuadrant-system","resourceVersion":"137679","uid":"cbbb483a-e15c-4152-bf37-5f33dc30c294"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b2a036eef771250380a27390d914c74936b69191171b88b607f8b1cf82db8b4d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b2a036eef771250380a27390d914c74936b69191171b88b607f8b1cf82db8b4d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b2a036eef771250380a27390d914c74936b69191171b88b607f8b1cf82db8b4d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T01:17:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"}],"name":"9d51b49a426f771721c7eefd4e5b1a3caf7b1d247837181e4bc089c073ab4efa","namespace":"kuadrant-system","resourceVersion":"137668","uid":"b335e278-2c5e-4c8c-83c1-67c0c21b1e2d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9d51b49a426f771721c7eefd4e5b1a3caf7b1d247837181e4bc089c073ab4efa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9d51b49a426f771721c7eefd4e5b1a3caf7b1d247837181e4bc089c073ab4efa"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9d51b49a426f771721c7eefd4e5b1a3caf7b1d247837181e4bc089c073ab4efa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.594Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-3"},"creationTimestamp":"2026-11-04T00:44:58Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:51Z"}],"name":"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf","namespace":"kuadrant-system","resourceVersion":"100996","uid":"c09c7827-741f-4144-a1b6-37ee867cdacc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.665Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:29.732Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:17:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:17:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:15Z"}],"name":"73e29825258c01cda83047eeec9c43a2d5dc72122f0a5953b06ebf240dc25577","namespace":"kuadrant-system","resourceVersion":"137685","uid":"96ad4213-4cac-46ae-ac4e-60f798787233"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["73e29825258c01cda83047eeec9c43a2d5dc72122f0a5953b06ebf240dc25577"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["73e29825258c01cda83047eeec9c43a2d5dc72122f0a5953b06ebf240dc25577"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"73e29825258c01cda83047eeec9c43a2d5dc72122f0a5953b06ebf240dc25577\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.806Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:29.878Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871#rule-6"},"creationTimestamp":"2026-11-04T00:44:57Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:51Z"}],"name":"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e","namespace":"kuadrant-system","resourceVersion":"101051","uid":"6d6415f5-6c76-4014-839d-8b694cbdd3f2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-516871.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:29.949Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9\" already exists"}
{"level":"error","ts":"2026-11-04T01:19:30.014Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T01:16:51Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:52Z"}],"name":"624946f22d91168e64c441b314dc0d26fba28deda94ed9b0756622ad4c1cd76d","namespace":"kuadrant-system","resourceVersion":"137141","uid":"3a434cf2-989a-417e-b90b-253e03a2bbb9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["624946f22d91168e64c441b314dc0d26fba28deda94ed9b0756622ad4c1cd76d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["624946f22d91168e64c441b314dc0d26fba28deda94ed9b0756622ad4c1cd76d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"624946f22d91168e64c441b314dc0d26fba28deda94ed9b0756622ad4c1cd76d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:30.080Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:16:50Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:16:51Z"}],"name":"bdd0e5f135e8c5bb8ffdc260c743af6cb6d6c8c49c8866f19f6c63325e88bb71","namespace":"kuadrant-system","resourceVersion":"137093","uid":"12b7bdef-adc6-468d-80bd-16dc53ab2102"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bdd0e5f135e8c5bb8ffdc260c743af6cb6d6c8c49c8866f19f6c63325e88bb71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:16:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bdd0e5f135e8c5bb8ffdc260c743af6cb6d6c8c49c8866f19f6c63325e88bb71"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bdd0e5f135e8c5bb8ffdc260c743af6cb6d6c8c49c8866f19f6c63325e88bb71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:30.146Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc#rule-4"},"creationTimestamp":"2026-11-04T00:42:32Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:49:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:08Z"}],"name":"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2","namespace":"kuadrant-system","resourceVersion":"99307","uid":"b5ee89ed-fb6d-4ca5-9bf3-286dcba364cb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-ad3cbc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:49:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:49:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:30.291Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-ad3cbc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-ad3cbc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:30.592Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-567653-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-567653-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:31.115Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-516871-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-516871-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:19:31.989Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"test-model-567653-kserve-route","namespace":"ai-tenant-e2e-inf-a-567653","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"test-model-567653-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:19:41.002Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","HTTPRoute","AuthPolicy","EnvoyFilter","Limitador","ConfigMap"],"eventTypes":{"create":12,"update":66}}
{"level":"info","ts":"2026-11-04T01:19:41.458Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:19:43.759Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:19:44.015Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:19:44.015Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:19:49.137Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:19:49.158Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:19:49.158Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:19:49.167Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:19:49.167Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:19:49.173Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:19:49.173Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:19:52.760Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:19:52.760Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:19:53.405Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-047f21","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-047f21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:20:05.723Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","AuthPolicy","Limitador","ConfigMap","HTTPRoute"],"eventTypes":{"create":4,"update":30}}
{"level":"info","ts":"2026-11-04T01:20:06.201Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:20:09.115Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:20:09.325Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:20:09.325Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","reconcileID":"0507fcd7-c483-48aa-ba41-da313aa1f900","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","reconcileID":"0507fcd7-c483-48aa-ba41-da313aa1f900","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-923a2f12","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-923a2f12","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-mt-923a2f12\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:20:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:20:14.990Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:20:15.013Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:20:15.015Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:20:15.024Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:20:15.028Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:20:15.028Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:20:15.249Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:20:20.106Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-923a2f12-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-mt-923a2f12-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:20:20.785Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-923a2f12","namespace":"openshift-ingress","uid":"d236a6c9-3452-470d-9eb7-20546d4206ad","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-923a2f12\" not found"}
{"level":"info","ts":"2026-11-04T01:20:21.986Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:20:21.986Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:20:22.170Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-923a2f12","error":"gateways.gateway.networking.k8s.io \"e2e-mt-923a2f12\" not found"}
{"level":"info","ts":"2026-11-04T01:20:23.802Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-04T01:20:31.963Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:20:32.030Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:20:32.030Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:20:32.135Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:32.201Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T01:18:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:09Z"}],"name":"307c361ec926214650cb5c2e4bb9dec1e4e8cebd71b651361277deb7e86e1626","namespace":"kuadrant-system","resourceVersion":"138689","uid":"23762e0c-c713-48c3-b406-30f3f77f0732"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["307c361ec926214650cb5c2e4bb9dec1e4e8cebd71b651361277deb7e86e1626"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["307c361ec926214650cb5c2e4bb9dec1e4e8cebd71b651361277deb7e86e1626"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"307c361ec926214650cb5c2e4bb9dec1e4e8cebd71b651361277deb7e86e1626\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:32.275Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:32.347Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:32.416Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-1"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:12Z"}],"name":"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea","namespace":"kuadrant-system","resourceVersion":"99550","uid":"18f49e3b-14bd-4be1-b69a-cce43a8cf8d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:32.481Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-6"},"creationTimestamp":"2026-11-04T00:44:24Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:12Z"}],"name":"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e","namespace":"kuadrant-system","resourceVersion":"99564","uid":"7d9bb096-d6b9-4d83-81ac-bf237efb3353"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:24Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:24Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:32.555Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:32.628Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T01:18:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:09Z"}],"name":"81d6009326dd8ee3649b6ac7ce6e5056815fb8e71ab61385e3baf97696221392","namespace":"kuadrant-system","resourceVersion":"138674","uid":"3fab10e9-8bb4-48e8-99f3-f1fc14b346d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["81d6009326dd8ee3649b6ac7ce6e5056815fb8e71ab61385e3baf97696221392"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["81d6009326dd8ee3649b6ac7ce6e5056815fb8e71ab61385e3baf97696221392"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"81d6009326dd8ee3649b6ac7ce6e5056815fb8e71ab61385e3baf97696221392\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:32.676Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-e89576","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:43:52Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"921550b9-e248-45c0-b3dd-b3c75826bf69\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:52:50Z"}],"name":"kuadrant-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-e89576","uid":"921550b9-e248-45c0-b3dd-b3c75826bf69"}],"resourceVersion":"100918","uid":"d0208b1f-740f-4ca5-984a-09841be9a98b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cecf4b7605fbf7a634fc7b77185b4d7ebd20a144604d11cd3007493370d9b207\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5968065d6dd51fab68e7417285424e21a64ac2973f6bed9828bdd659ed75dec8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"ff38a8dd86d72f9d45f0de09699dfc4b29d6ee8abe6ae64ec71eb55cb6ef3b0f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5bb2cfdd387e9aa87d4d9baf87427f174766e18e8cf38c6b57956550b03c676c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"386502c5dd83df97022073a1e98d64ac59e072b17950191d54d002866028ff7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"a29eb6eb82b8a6d9d1fd9dae787032bef13343b86e0f6b0b34c3cf7f3de7af14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"be28ae124b98fbf7b5572d93f1b0040112082d0b3cdbb1a7a6688b5b8961f224\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"c7fc5d0eed87978dd3b0ff87a901f0bff000b0ce841924bd7655da42456967c5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"3ea848ea7a28ccec66fa770b3af2452b6b0b907146017230150b4eb245cdf478\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"b48f9ffb16488230ccfba7be12fecc14d77ffaa6791fac31cfdf089d3bd9cf19\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"877b5e6c6dc95c57bc96a4d2f0ba86cbcab176b129452b31536b4fdf4d531210\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5b894ed9f23e961b2cf22bae67fb738504c1f61e13fbc6c166efb61c3eca2e4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"51344648a80299e3b222af703676b7a62676f72287aa79688416c859a4c25cfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"dba078fd7ca177486b349b8d338b6ccfef6c1b8961d4726399b7a45f21f9dae5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"f803be84bbeac273c0d64f93aca27674f3c0e7847ca5ced702565c583f4238e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"ae1cf6a82a4436771fc3b0c14d82ec7179cf59fbdb95dce09ed277754037e455\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"6af38bba1645e8ff2c0a6565dfe8c1d12b1b889eb78d44966a52b7db415cceb6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"4f18cd88604b5d76771cb0b3ebb10ba91f9bc3110a51d21d0be4bd9feaaecb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"c147090c7a09ad90ca5c712b319bcc56ce9201f784435f4fc8bc7fd22966b64f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cbb2bfaa3f7807da810e5291128dafdf0ad6a95e35e1e8579ba5c146fe1b92b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"755a0cc7a588e772af9132fcda445bc892a59b574f2f7284b043f1d478444943\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cfbf9c267cd9cb7b63a74fd1748936a93876c7424601b821496ba7463c22e3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5b4bf640448cf71b6adb08f5416cb2f93badffbd5e65a485b88a5db0cb08b40c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"493cb8642d7cbb23499392f14e4d28be76ed3e633c56318221b47ff22efa9714\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"8b6481563e46a2c4798f147ec4a643710acc55f443ca552abecbc4c0e50c57ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-e89576"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:32.713Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-3"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:14:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:14:45Z"}],"name":"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c","namespace":"kuadrant-system","resourceVersion":"133158","uid":"ad50fc20-656e-4975-8548-130209391de5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:32.784Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:32.849Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T01:19:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:14Z"}],"name":"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16","namespace":"kuadrant-system","resourceVersion":"140030","uid":"959acf43-8330-4365-b328-2fb871e76be8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:32.920Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:32.986Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T01:18:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:11Z"}],"name":"9f06990fed67aa4e3cdcc906e61d569d1d21161a2dbc6c35f085ca529b3d2251","namespace":"kuadrant-system","resourceVersion":"138761","uid":"7521f3b3-9817-464c-b2dd-921e78c0ebfd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f06990fed67aa4e3cdcc906e61d569d1d21161a2dbc6c35f085ca529b3d2251"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9f06990fed67aa4e3cdcc906e61d569d1d21161a2dbc6c35f085ca529b3d2251"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9f06990fed67aa4e3cdcc906e61d569d1d21161a2dbc6c35f085ca529b3d2251\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.078Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:33.149Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:18:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:09Z"}],"name":"617041f6163f04acf5be2ee3a6a363ac1bc3ddf062941091d28338085032c7e7","namespace":"kuadrant-system","resourceVersion":"138692","uid":"c8a00853-337a-4a59-bd35-89681329d83c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["617041f6163f04acf5be2ee3a6a363ac1bc3ddf062941091d28338085032c7e7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["617041f6163f04acf5be2ee3a6a363ac1bc3ddf062941091d28338085032c7e7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"617041f6163f04acf5be2ee3a6a363ac1bc3ddf062941091d28338085032c7e7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.220Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:33.238Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-047f21","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:17:48Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"41aa6dc7-fd9c-47f2-93d6-c8025cf52430\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:17:48Z"}],"name":"kuadrant-e2e-inf-b-047f21","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-047f21","uid":"41aa6dc7-fd9c-47f2-93d6-c8025cf52430"}],"resourceVersion":"138332","uid":"107f97d8-2196-4b09-b0d8-db8ccea12843"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"4d3b12844769d288ee3ca896036c825b5a7163e7b31f6c4263a9fcd4c48a578a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"e0cfe7fffb0aa3094b397c2a23db023872afb5a732e743b4c2d867bd7679135a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"02bf8f8027806842da4d1d3d8f57f43c0cf6a547dd2ba55a94652ccc7b8018b3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"54c925a1fee74830e5a8669286538dda41c1ae1c7f2875ac531e02e1daca9da9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"9f43ce99c5eaf6aec55bff28957556c398e8ecd096a8cd5bceb4b3eac93b78a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"51b334c448fc5ea2c210cdf8733c3ee190a3ad0426b1ab214adc49bd9822f58d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"6a5223ae23ed603062c6014d5f3f5fa3a7aa8a574c0c81f47ba7ebf89fa2eb50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"a70ed70d296dbedd59bcb3f88e9ffa78b1583d1fff1a3b9c8d579c0c088401a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0525c4c0827a4fa7a2054dbb397d0948b85f8ca7bacfc94f5663dd80f43acf2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"731736f274954f42070a1a885b62b46aacba13086865b31d54c2f423668b3b53\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"176c29e780c2eaba3e3b683539283dbdaa8a7665da1387cdc4723b51a1d9c65b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"e19cea8e5adf9dc683d291f9c795375f7eac7f4cb46fded34748a6d63d7b45b4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"480714bb8f307852512911bb73a7a26683803e376f0b44f0f227825cd8f8b434\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"61a6ae6895d13a67e123363adbee3a4e1a8565c8dfe16bbcff34648f2dbd8a34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"3c6658e781631113d28de9a0cb9236f2583c53fd04824374c14d80f33562c6f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"d98398700c360a5b428c7f4c578ba075444a74ee829feb2e8abd052fa6934fac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"c897ab530253a27d5288307b3e424332dd5394081fc64ca973a16fb6809b4b86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"972e26c338c6bbaf2d6b00e7341917cdebee58e6f7538e5676988eb9d27b7eb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"3b6796f2c0d93432094451e5c1e49ad61fa9e5c868dc783c687ddedcfb30a6ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"bb86083e4eb85f183a6ec5d48b076eb39b7ee7621df57ef7cf7eba43e1b04596\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5369fb14b4c9747fff329b6d22b318dd96b34aaaf0bd9f2df40bf15e7f913b79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"d163e3528bca5c6ec3b38b1456f4954a1629aa74c70340eabdc3c1032e4870c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b32e3e3179c8a47858f894ead7a8edda326b68ece2835880b4e91d10a2e5ef21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"20bc9de53bbbb54bcc22326d899764888ce871183d0e4f2f7e839ebc2618cdb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"966a3b89b25f42fa12afb1fa01a22d057abc3a21a8ec51e3d0f3c83c63e49d9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"0f49ffe44f2a7ea94716bbd9f932ea3b75cefc633dc7edf36b92fb54d485d2f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab7f9daf61f4b9a1a0524772716f8d4e8cc444346633083f3bbe60224de5b5da\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"15e495cb76331be1871831d6cd7a3bfd2763cdbd85b016277d6e3c0e91bc15c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72b09fbd9717a531761117e8a137c042ea24289b5ac302a96ee4aecedbe123ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"0b53a0a51f013fe565ccba1c8c082dc2ab58cbfc6228672d4295281ea5323df3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"3861b2b53b529934f41dfdcd7ee1dee9f1d5a7d630d60c94a056a7ad761114a8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-047f21"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-047f21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.286Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:18:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:11Z"}],"name":"c1b2b8e85d76ff0d584379811211b4148b06ec73c74a836375102374954363d5","namespace":"kuadrant-system","resourceVersion":"138752","uid":"fd218939-7c43-4113-b785-8f97abe1e234"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c1b2b8e85d76ff0d584379811211b4148b06ec73c74a836375102374954363d5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c1b2b8e85d76ff0d584379811211b4148b06ec73c74a836375102374954363d5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c1b2b8e85d76ff0d584379811211b4148b06ec73c74a836375102374954363d5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.353Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-1"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:14:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:14:45Z"}],"name":"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995","namespace":"kuadrant-system","resourceVersion":"133155","uid":"d507ad55-2556-459d-800d-367eaddc1ae5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.420Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-3"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:10Z"}],"name":"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334","namespace":"kuadrant-system","resourceVersion":"99454","uid":"b34fad4e-4aa3-4133-88c8-f305c7b0ccce"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.486Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:13Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:13Z"}],"name":"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9","namespace":"kuadrant-system","resourceVersion":"139989","uid":"90a5d52d-8433-46d8-8d5c-2f9ca55f0c29"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.557Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:33.622Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T01:18:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:09Z"}],"name":"495f508b4ebccd223482b69eb03259ed3f378858a1214a16d638acf9d64861c0","namespace":"kuadrant-system","resourceVersion":"138685","uid":"d69cfa53-bc07-486c-ad8e-9c1bb782143d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["495f508b4ebccd223482b69eb03259ed3f378858a1214a16d638acf9d64861c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["495f508b4ebccd223482b69eb03259ed3f378858a1214a16d638acf9d64861c0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"495f508b4ebccd223482b69eb03259ed3f378858a1214a16d638acf9d64861c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.668Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-mt-923a2f12","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:16:51Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3f6789e1-0d7c-4fab-a5c5-8fd8dcf2fa9f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:51Z"}],"name":"kuadrant-e2e-mt-923a2f12","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-923a2f12","uid":"3f6789e1-0d7c-4fab-a5c5-8fd8dcf2fa9f"}],"resourceVersion":"137125","uid":"5f274615-2f7d-406d-91a0-dad097cff467"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"747b6c99ee433c7735d28554e60181cdbca8789c4db7921de052fa6aa99805e9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-923a2f12-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]}],\"name\":\"26cc9ea7820e6382f714cfa8b96764a744964372f8dc469ad0563374a134e132\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f6bbfa9fb218567f8b688067fbd115b361fed4f99617fc2e1a0f3ff92b4e6ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-923a2f12-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]}],\"name\":\"45648357870ad699fbaba67d9264fac473346d241837c6ecbea6236862b468c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e63c2328a2c63ba7d03932075549456c0730eead03c427d16f8565c34b97b754\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-923a2f12-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]}],\"name\":\"4b54b224dab2cb45ad974757e5c553c7aa0c22d2cae77b47ad8e9ab617a82033\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7182af09e86163b198739d2be66ec4ce36bc213aad1e2360630c656846369f7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-923a2f12-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]}],\"name\":\"e98267c6b062e2502e9c201514445177b7221b1a5e3a17ef9302953cb49372bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2eddd754ecffb9a3283f7d0f0b2be0a9322bb0987f5c853c896f3d879dae24b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-923a2f12-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]}],\"name\":\"9bf87c684a656192b15191815b33b8c0667077ea842f421597ebcbd20d9080b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c06e30a9e36bf8e0f1b678570758792bf6cbf161c8b4f35049e1ba3b480dca0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-923a2f12-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e676254f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-923a2f12\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-923a2f12\"]}],\"name\":\"a54a2aa2784942354cf766eb761afa3baa839e0d54dccb0deaf0923340bd7356\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-923a2f12"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-mt-923a2f12\" not found"}
{"level":"error","ts":"2026-11-04T01:20:33.688Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T01:18:11Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:11Z"}],"name":"91289812b821ff7cf3d67f16d28e61df5c68d710829fec0f0e316503740bf5a2","namespace":"kuadrant-system","resourceVersion":"138765","uid":"d074854c-917f-4d57-b81a-7eb3ed81a8e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["91289812b821ff7cf3d67f16d28e61df5c68d710829fec0f0e316503740bf5a2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["91289812b821ff7cf3d67f16d28e61df5c68d710829fec0f0e316503740bf5a2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"91289812b821ff7cf3d67f16d28e61df5c68d710829fec0f0e316503740bf5a2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.760Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:33.831Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-6"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:14:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:14:45Z"}],"name":"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3","namespace":"kuadrant-system","resourceVersion":"133166","uid":"4e57a39f-136b-4d7e-93ea-d7605100d540"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.898Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T01:18:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:10Z"}],"name":"27e710700a9520c20146033207ee7e80e02a212b1fd53006aeb30ee15b136dee","namespace":"kuadrant-system","resourceVersion":"138733","uid":"688876ea-4ad6-4a5e-bb54-0aa102a4d3d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["27e710700a9520c20146033207ee7e80e02a212b1fd53006aeb30ee15b136dee"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["27e710700a9520c20146033207ee7e80e02a212b1fd53006aeb30ee15b136dee"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"27e710700a9520c20146033207ee7e80e02a212b1fd53006aeb30ee15b136dee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:33.963Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T01:18:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:09Z"}],"name":"ff8c0672ab4140ed7e3066eb6858ba9dcc1c48e66a82564c44bc66f885b3cdcf","namespace":"kuadrant-system","resourceVersion":"138678","uid":"e5be834d-c0f7-4d4f-8c5f-570f0fb1533f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ff8c0672ab4140ed7e3066eb6858ba9dcc1c48e66a82564c44bc66f885b3cdcf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ff8c0672ab4140ed7e3066eb6858ba9dcc1c48e66a82564c44bc66f885b3cdcf"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ff8c0672ab4140ed7e3066eb6858ba9dcc1c48e66a82564c44bc66f885b3cdcf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:34.029Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T01:19:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:15Z"}],"name":"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7","namespace":"kuadrant-system","resourceVersion":"140066","uid":"2dd7ab8e-c90f-4026-9a20-42bcf5d40244"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:34.100Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:34.165Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:19:12Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:12Z"}],"name":"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a","namespace":"kuadrant-system","resourceVersion":"139933","uid":"a94ae380-23fe-4ace-94b4-ef2e33cd42b5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:34.236Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:34.304Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T01:19:12Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:12Z"}],"name":"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10","namespace":"kuadrant-system","resourceVersion":"139940","uid":"273d9374-f094-474e-80ee-d65c2bdf9b27"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:34.370Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-5"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:09Z"}],"name":"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464","namespace":"kuadrant-system","resourceVersion":"99328","uid":"4b2ce0a5-a4a8-44bc-934b-813461b496fb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:52:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:52:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:34.440Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:34.512Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:34.583Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:34.649Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-2"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:08Z"}],"name":"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299","namespace":"kuadrant-system","resourceVersion":"99296","uid":"1056e779-86f6-4e62-a684-252a104d3b03"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:44:23Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:34.717Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T01:18:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:09Z"}],"name":"e8814ec0bcabc1d155178b62b9f706a82456863dc9d4a57fd217c25b8fbe52df","namespace":"kuadrant-system","resourceVersion":"138683","uid":"bbabdd38-ed62-4c20-bb0e-3c42bffd1a28"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e8814ec0bcabc1d155178b62b9f706a82456863dc9d4a57fd217c25b8fbe52df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e8814ec0bcabc1d155178b62b9f706a82456863dc9d4a57fd217c25b8fbe52df"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e8814ec0bcabc1d155178b62b9f706a82456863dc9d4a57fd217c25b8fbe52df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:34.789Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:34.859Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:34.929Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:34.995Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4#rule-4"},"creationTimestamp":"2026-11-04T00:44:23Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:50:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:52:09Z"}],"name":"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2","namespace":"kuadrant-system","resourceVersion":"99335","uid":"741267a2-419c-408c-9ffc-5c69246c79cb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:52:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:52:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.065Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:35.133Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-2"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:14:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:14:45Z"}],"name":"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1","namespace":"kuadrant-system","resourceVersion":"133168","uid":"bedfa101-faa4-4a9b-b3d8-f82d50554fac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.197Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T01:19:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:15Z"}],"name":"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9","namespace":"kuadrant-system","resourceVersion":"140070","uid":"56e2ecca-508b-4fca-80bc-addb0d7f7381"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.264Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-5"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:14:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:14:45Z"}],"name":"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da","namespace":"kuadrant-system","resourceVersion":"133169","uid":"966d1504-e68c-4923-9a96-7cb055586ea5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.332Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:13Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:13Z"}],"name":"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a","namespace":"kuadrant-system","resourceVersion":"139997","uid":"71e7f37f-68e5-49d2-9455-772a600eabc9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.398Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:13Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:13Z"}],"name":"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43","namespace":"kuadrant-system","resourceVersion":"139985","uid":"3f2d7ef5-b8c6-4123-b586-e87a2946a337"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:35.547Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:35.614Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T01:18:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:10Z"}],"name":"d3a7e292ed41cccc00138c0668dcf4316413fa3a9288ab3eb15c4acd6c7ebdf0","namespace":"kuadrant-system","resourceVersion":"138710","uid":"f021bccc-8d83-4c31-ab00-6d0c153c3527"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3a7e292ed41cccc00138c0668dcf4316413fa3a9288ab3eb15c4acd6c7ebdf0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3a7e292ed41cccc00138c0668dcf4316413fa3a9288ab3eb15c4acd6c7ebdf0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3a7e292ed41cccc00138c0668dcf4316413fa3a9288ab3eb15c4acd6c7ebdf0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.681Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:13Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:13Z"}],"name":"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100","namespace":"kuadrant-system","resourceVersion":"139972","uid":"ca2a455f-5534-4e85-b98f-c25267f536fc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.748Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T01:19:12Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:13Z"}],"name":"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb","namespace":"kuadrant-system","resourceVersion":"139964","uid":"7d5131e2-4381-4654-8619-952c2679534f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.816Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T01:19:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:14Z"}],"name":"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9","namespace":"kuadrant-system","resourceVersion":"140045","uid":"8ec2d272-10e7-4175-b66e-85ce1f83a58d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:35.888Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:35.956Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:13Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:19:14Z"}],"name":"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1","namespace":"kuadrant-system","resourceVersion":"140019","uid":"d2791765-a223-4f36-a5a0-464fb6635fb0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:36.022Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-4"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:14:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:14:45Z"}],"name":"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b","namespace":"kuadrant-system","resourceVersion":"133153","uid":"fdfa1b7b-f8ca-4151-add1-e0f21e430f97"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:36.095Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T01:18:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:18:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:10Z"}],"name":"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe","namespace":"kuadrant-system","resourceVersion":"138750","uid":"e55ffab1-595e-46ca-aa31-b4e489afe711"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-d48ff4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:36.167Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:36.237Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346\" already exists"}
{"level":"error","ts":"2026-11-04T01:20:36.464Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-567653-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-567653-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:36.609Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-516871-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-516871-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:36.755Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-047f21-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-b-047f21-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:37.052Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-e89576-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-e89576-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:37.203Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-923a2f12-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-mt-923a2f12-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:20:37.425Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-238db1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-238db1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:37.534Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-a4fac5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-a4fac5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:37.604Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-d48ff4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-d48ff4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:37.817Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"test-model-047f21-kserve-route","namespace":"ai-tenant-e2e-inf-b-047f21","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"test-model-047f21-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:38.314Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-e89576-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"rate-test-model-e89576-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:20:38.370Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-923a2f12","error":"gateways.gateway.networking.k8s.io \"e2e-mt-923a2f12\" not found"}
{"level":"info","ts":"2026-11-04T01:20:47.265Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","TokenRateLimitPolicy","AuthPolicy","ConfigMap","Kuadrant","HTTPRoute","Limitador","Gateway"],"eventTypes":{"create":24,"delete":9,"update":77}}
{"level":"info","ts":"2026-11-04T01:20:47.776Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:20:47.783Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:20:52.435Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:20:52.454Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:20:52.528Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:20:52.529Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:20:52.529Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:20:57.649Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:20:57.728Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:20:57.739Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:20:57.740Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:20:57.741Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:20:57.758Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:20:57.965Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:20:57.965Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-1c8dd4","reconcileID":"9e858d93-f236-4333-9b18-6d53a6eb135a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-1c8dd4","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-1c8dd4","reconcileID":"9e858d93-f236-4333-9b18-6d53a6eb135a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-1c8dd4","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w0-1c8dd4\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T01:21:06.865Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-1c8dd4","namespace":"e2e-models-e2e-worker-w0-1c8dd4","uid":"22a860a6-a2f3-4ff0-9cff-a05e107c87a2","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-1c8dd4\" not found"}
{"level":"error","ts":"2026-11-04T01:21:07.233Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-516871","namespace":"ai-tenant-e2e-shared-b-w2-516871","uid":"2283b4bc-b8d6-451d-a676-089dd1553de5","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-516871\" not found"}
{"level":"error","ts":"2026-11-04T01:21:07.724Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w0-1c8dd4","namespace":"openshift-ingress","uid":"0ae322bf-4295-4191-b47a-278c4bc91a74","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w0-1c8dd4\" not found"}
{"level":"info","ts":"2026-11-04T01:21:08.468Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:21:08.468Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:21:08.988Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-238db1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:09.013Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w0-1c8dd4-kserve-route","namespace":"e2e-models-e2e-worker-w0-1c8dd4","error":"httproutes.gateway.networking.k8s.io \"simulator-w0-1c8dd4-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T01:21:09.048Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-1c8dd4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-1c8dd4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:09.139Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-238db1-kserve-route","namespace":"ai-tenant-e2e-shared-a-w2-238db1","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-238db1-kserve-route\" not found"}
{"level":"info","ts":"2026-11-04T01:21:21.529Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Kuadrant","TokenRateLimitPolicy","ConfigMap","AuthPolicy","EnvoyFilter","Limitador","Gateway","HTTPRoute"],"eventTypes":{"create":1,"delete":20,"update":121}}
{"level":"info","ts":"2026-11-04T01:21:21.931Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:21:21.939Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:21:25.927Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:21:26.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:21:26.254Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:21:26.254Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:21:26.263Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:21:30.154Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:21:30.164Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:21:30.164Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:21:30.213Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:21:30.214Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:21:30.221Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:21:30.379Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:21:36.275Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:21:36.275Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:21:37.951Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":2}}
{"level":"info","ts":"2026-11-04T01:21:43.953Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:21:43.963Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:21:43.967Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:21:43.967Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:21:44.075Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:21:44.075Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:21:44.652Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:24Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4822deea-cfc7-4012-8bab-7aa664065e4f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:18:09Z"}],"name":"kuadrant-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}],"resourceVersion":"138701","uid":"2cb81ab4-d10b-47fd-8ee0-a5914960e25e"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"8d6421b06578687c7ef644a0fe88cfb38e0608890db5ac6c5a6d9f4f8dc90481\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"a761ad19fdc382d53087898e929beafd8f0790b442221e9f239ea6a434b439c5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"455e048b6a1946fb9947da63c3f8d59e6d34e3488858e59298d5a7d3bea4cd98\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"7887a43b7ae5a8d62d604e5154127b44619058c191f88b4194e6f09d4f61299b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"2e79a7d9837a9c856545b5f91a2b4656e646a902c600154dd1b70aae6b212783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"ae29fbd03447db865e3a34c5892d686117686936f6b3ba2d709b66d0e1262277\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"22a4b46e48633463c1b8972f22694ba96e54eeda51a9f8f0773979b73d850a0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"b9582a40db1dd463eb82d69dbd7f7bc26ac73cfb0a3fcec8766e386a4bfddaeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"a8145813a9b56dc34ed50dd81fc379ed19f75a26ecc67269c54fb433b09cd1a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1b2b8e85d76ff0d584379811211b4148b06ec73c74a836375102374954363d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"28a89dada33d49cd8992e7f35318e96c39560b09cfc58c082359f5e87e4f97b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"617041f6163f04acf5be2ee3a6a363ac1bc3ddf062941091d28338085032c7e7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"4eae637e0ab62992e32fe2e681e6a1d9270776a9f954a42156aea6c738d6f33a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"81d6009326dd8ee3649b6ac7ce6e5056815fb8e71ab61385e3baf97696221392\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"8ef6638e06a317f52df937c0b7122657de5f72505fcdecc529ae4b2cf4150d8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"495f508b4ebccd223482b69eb03259ed3f378858a1214a16d638acf9d64861c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"1069a236aa8747a14b4992df655c29dbc39d320a3a9284bd49a02776379bb00d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e8814ec0bcabc1d155178b62b9f706a82456863dc9d4a57fd217c25b8fbe52df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"b45b8c08a1830940e4927264ca1a60ed34fb3c9356f2e1f7fd9a58f96ee1f953\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91289812b821ff7cf3d67f16d28e61df5c68d710829fec0f0e316503740bf5a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"6a65cc6feea85f27d35640f9bd6857abffa424c8deee32e8614534a6986334fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f06990fed67aa4e3cdcc906e61d569d1d21161a2dbc6c35f085ca529b3d2251\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"7e7e6a3c40df2c03e1078dca9383c23098dab0192f31bfb474bd27960b091e81\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"307c361ec926214650cb5c2e4bb9dec1e4e8cebd71b651361277deb7e86e1626\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"70b4494195ea6e75441af73b4f66a05c98d1269f57642f590f95fe2a61259379\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"27e710700a9520c20146033207ee7e80e02a212b1fd53006aeb30ee15b136dee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"1200dd0431e234d4f176a66f30ab65fa50f77aaaa2b07e18e20bf563b77099f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3a7e292ed41cccc00138c0668dcf4316413fa3a9288ab3eb15c4acd6c7ebdf0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"f1f3ce9d46b59d1db0b388eb691024846c1b3a0984d752bbf0e089f5f1013788\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"dbd867a3282f4d3f0b2224e9a0a717b6688c4853b976493add937469edc9dfb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"79016ee4b4f966cf6c441f34579ea049f63637553b8193324bae0aa836b2db7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"df2665493c1179abe9d1eb2a996b4ad965011d3b3e7e7451c8f64999ea7e5e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"c8cc7f1ee42f8704cc0aa6fe662e93eb76b065868d0b1ca19a262a9434302ebe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"37694e0fe4a8a4daee6cd09ea67587f3f90a67fba636fb5f0a92fd82ec0cf000\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ff8c0672ab4140ed7e3066eb6858ba9dcc1c48e66a82564c44bc66f885b3cdcf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__276fa282\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f13607fa09ef5aa3\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__e5e03964\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"6b8bfefcb737bfd5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-d48ff4/maas-trlp-sub-test-model-d48ff4\"]}],\"name\":\"cc7b48fb57550ab56f5828b5565a201b7710a52f1274cd6aa8b12b8b47a15da0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:45.060Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-ad3cbc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:42:33Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"76771efd-f8cb-4c36-a180-ec37c18f7a04\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:16:52Z"}],"name":"kuadrant-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-ad3cbc","uid":"76771efd-f8cb-4c36-a180-ec37c18f7a04"}],"resourceVersion":"137150","uid":"100f1380-dea9-4628-a307-626162a0de0f"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"eb7c5f6146e9b7f198f7bedb81b1a9792ebc5496512bba8b470fb46812ed2c5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"87804eb40c5d527ed12354c8f571b09b036b3c74ce0c4c39667b3fc315c4905d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"4b43e824aacf1c64cc248213c49e7be4e775e54e026b348467d1b8a7cacfcb44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"3e519323ee8e91e2091c85e88a1f7f05af9c2bf69f593ed54f9455d8c8729b07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"5100d5230fb454e4921222ed711d873d71f9476545e81473362af8d89e371f92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"bc7d702bc2da253b1c4414a843d19dee06418bd51f447cf34b5d084d2fe4db99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"f6eac613cd17f9fde3efb461554fce5688bce1d80cb579779d38722324cd9ccb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23608a7c80be457d40c87b6a3db184f8eaeabfd377cf8712555f204ca3fd5d3c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"42b00e2be7ede8770d3862dc9f41d1fb00a36795fa3c30f9d2ef19471e46e924\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"9bf97f063f975f92080a902131d0daa53318e53d91b57013cbc27123f26504c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8a1a2ef7307594be5b839ab2b8e52376f53c0aede134ac0f2b06e097ed15fdd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"fe6d62af96cbedeec610cbe44e2ed428b95daa7f3ccea3dc9e1d8924ec252ee6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdd0e5f135e8c5bb8ffdc260c743af6cb6d6c8c49c8866f19f6c63325e88bb71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"323e04ec06c18918d61e8699e662c28ca707abbd9f66ec437d262a75e56917e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fea0207530cb2c23c7160f6f6c4e418b33c12941232cf555b00d867472f65d48\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"2faf2918e9b350f75c3a15e992728ca4d636a6b66d43e453b09be7f438a90014\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"89ca25033a5c3ccedd6f93e26e934793a06bec170890a586a8ece7a6a91dab27\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"70e2df62b681f62fa452759531c300882b765b6c25ba3c791531f07433331daf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce83233ea29dce22f30dd59797c1b10d9dff4c9d10b358802da3553405d4a8ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"903e489f6d7564ad2395cb8d44f55d58a3b852724072b3cb91791e6cb1d0d19a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e507dcad01174c518e1517f33216112d236677ce5e65f7a75ab9708fe267a09c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"141d5c871ec1fdfea4d9dc20ae1fb524b13dda735f43a2a6fad9ba9a9f80c614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5a29300ac895d44aaffa06bff6601b0d7ca713ecc3c59f292293e4a391c7bb46\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"08b2dcb3d221fe59fc90eb8295e2f9efbb6fb4cc3f6c72eb689f8916ab1fdd04\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1654f8b4b79bdfda4497c1d19df70d990bc6595d7ebab424c748106829bf0fb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"2dc3c45e33d2eb56efeba0e47c09f863e0e843a0f258355b011dcb8f5c23bcbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85e855fcbbc28ab54202a13b642bbb677e84cca41a6be3c9c8c34ffeecbf498c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"f08ef6a3026c6ef1df6b2260097d3a89990baa5d5ea2662b2dd5badb6ee1a578\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"624946f22d91168e64c441b314dc0d26fba28deda94ed9b0756622ad4c1cd76d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"b2ca86230e9bc59cb7a0e6269e6a4d013f8f9cd498608eac1df67d9c97413ece\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"5dedc6dee45d1abee8c19f6f4c42fb55d06758b5fed0909cf21751bdfe9be5f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"980887992cc7e6c74980cf1fe4e50f09c0f06a300c9323cb555f8f0c45740837\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"92fc99421f6a2bb91b311a13d2db9c621790c803fde132892e7873aa4bc3675c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"967c3cc0acbbd5cbf744b398accf5c5e3d0d0e23659fc20e69ddc0bb3f0a8d96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a203dd48\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-ad3cbc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-ad3cbc\"]}],\"name\":\"92303fb39cb3b4f32df939e72e4c266d891b1f7daac1e5e5697090cfdc30cc3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3feb0a16e30f084b3e838206e754c2e0d3aa634927efabf4ba030ccffb4c0586\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-ad3cbc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__8c177d09\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1fc8b609aa8acf74\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__bd51d665\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8cd500ecfc388b98\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-ad3cbc/sub-test-model-ad3cbc-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w4-ad3cbc/maas-trlp-sub-test-model-ad3cbc\"]}],\"name\":\"054021a1ad2d18a62a7a7fec07d5caeebabe2d204bf0e00f85a629d47717ce9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-ad3cbc/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-ad3cbc"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:45.190Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-567653","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:14:46Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:19:12Z"}],"name":"kuadrant-e2e-inf-a-567653","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-567653","uid":"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4"}],"resourceVersion":"139945","uid":"88d15361-4538-4067-a295-10eac23868b7"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"7a464ef9ab6a4e807ef6453fd2cca0bd0dcbd605c836b6a068a16ff289505d5a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"cd5092683273efc9431833eedef34efcb62a5c43463dcce3dc9fee55aefa712a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"e7fe8a923fd511b559bb25ab3cf3ea4e9bf138ae8d76edafb05b7b5c40bd6d03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"4188fb0dc9ece2a5759c276f2daeffc7e035159b820ed2acded71ad02ca02161\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"2d3f1d7d82d384117ff72d69e4b1d29343ce9951a2f78bdd15261ab2cd32f4b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"5b09c64ba50c301b74e83debe623de502a5f5d0c19fb68f4a990fc93502e0597\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"a39e74ddab347d8ea71b7410ff253c056b462ef3653d578b1c19ae20ec1b7c1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"e5e65a84864d98c65f00b26f4b5242a8f770672db5d962600cd902e1e256773b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"0b1a56521a0c26caf235871aedb602b5e8ec34d357cfb5bb798739db3047de74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"77b558817b8449256a10bef565a9f198782f74ed89b684f15ee32711fc4024a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"8b520257c496ea4fd6dc57e8aafd96a5d4f480d07214b9eeac46c2a0bf6c1182\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"3892e12b6d49759143234e20e4266c21b56ac13e325f28042ed865f8165dc673\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"4a4982ac57138aa21be8768053ea4b0c87eb19d4c2208497b48311e0c64d14fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"59843c32c3a7620b0e11b75bf3e41573684a47a7eced56b076841142b77365eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"02ae347d6cfde776ed074d8d34839bbdbd9abf37ec62a9fee05d88a9d480f38d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"abdbb2b6dbf72730a51659bb8d10df4db4b3800b156128e26017899aa817b420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"5f241107e79a1d2ae1b9667fbaf3d45cf23ba11cc11a681259bd7fcb8fe7e0b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"ced0afc84cfa49bcec48eb13dba447cf0b029476d7e527e2199dcdd94d7c67c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"08d1152a95c976913421b236410d0074ae88a050c4be81772dff1cc8d06c13a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"5eced2745940640ce546e289f8794270a15642dd276b93577c3de730b4c6382f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"aaef5613c6cb1087de33139be37421ba4d698b456be39014dd402b24437f09a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"64bd01c13d26bc3e567f123ecf2f8183f58e588bb3c05cbf5bc07047e08343e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"6d4943470a0993df71ccd3c155e0dc41fccb2eb62830f9abeb2b635e3f12329f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"89b769ee6e98227227bd288da26910ca294c4e62a32888de7fe4577fb38a24b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__ac1b02ce\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d987ba390f9f5aa1\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-a-567653/maas-trlp-test-model-567653\"]}],\"name\":\"9e257201f64bdb599c9b19f0e840bc05fa9f25afc4e67fd3c09e6221ee71ba8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-567653"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-567653\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:45.824Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-238db1","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:42:33Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"a871959e-14fe-46d3-b8f2-00d3bcc71d04\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:58Z"}],"name":"kuadrant-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-238db1","uid":"a871959e-14fe-46d3-b8f2-00d3bcc71d04"}],"resourceVersion":"142425","uid":"35f27ffc-a00a-4ce9-943f-67b61b438389"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a68a00fbe4ede3c0b38fe9870b558dc6cca1ac15f393e533ce225212342e5576\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"7130a2cd01d2c1a8eecf067d885e4657ef312b3d7f30b5e4eac4739658bad541\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"31f0143a60e13ea6745e7fb61bde4910bfe6acd14bb292dc0539b5f33d751f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"d45b1d00670fab41fe4c23d7fbdb9884306dde94843215fbbfd65a3cdb95fbcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b289e3f1befd913bc5c27df0099b83939379105282e4bf360d74f9846054df84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"9039dde6e4107ae3eba9b18e0b483eff317c0a81f9dbd120da663535aa39f3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11c6d0a651652f81b1b93abb5a792126b56c88e30da1b18d815362f7b0ce56cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"8c0d0766432c32f4d1cb9cc2e54ca90e3333e0f672a08ec2e6034557027a73d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"449ca852af47a1b5a00efc7a8325cd4c05b2d460e01b696fcc011d14e0dab138\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"a57315f66093f4812f37dc0bf446d25423c0602dcdcc77576c94ee00e028b707\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63d30fa15f0c2b6c6f5fb22c3e04535e150fe07e2a1261ed59945ab2a4689711\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-238db1-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0c5953d8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-238db1\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-238db1\"]}],\"name\":\"91f6dc455b873524b4e6dd78ce85bc6951242eecb740adc87c5d8fc271c787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-238db1"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:45.950Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-516871","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:58Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59262430-a65d-4fb9-8082-a5ebbf86b6f6\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:16Z"}],"name":"kuadrant-e2e-shared-b-w2-516871","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-516871","uid":"59262430-a65d-4fb9-8082-a5ebbf86b6f6"}],"resourceVersion":"141306","uid":"f7839c9e-8ba0-49f2-b1b3-fba72e0e34b1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"9341334deb86e1208825acd707354bae6777e9e3a4a9a3485fb539a3a382ab2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"c79bc2cd4ac93976282ab96cf9b75a411fbb1917dbd9aae0f3476d7bd19e78a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"0b0ed4fb7995005c4cc0d5ca7e414bb9f8e9c0a70f7d699ae5da03ab239ae257\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"41facbe8b7db7d88a22100b69cbc526242da974439fc726ee417b6d703def3f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"ca005267f207bdf492e2b390760e781e38168c6a773d4d5d73c15e25896350a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"a7a4c68cad8b0020684e62605ec4c1fe79e3b4d6e15ecd868a24998ab43381da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"661813093bc81a3612217a17d2bfe68e10bdef57b3f6c86b36de77610f16e64c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e244330fb0d1f0ac0844e2924eab4a8e4d64e9f905cb3818f80f2519fa728e9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"caef75778c8829b8a1ce356cccf9ef9db99ae37266bf42513bf61ba0e723c71c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"b0bdf1559fb724e46b834693961ac80012ba18b84f1f7e761830354d69b6c20f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ba889df5f2f16479ed4a037206d97ef3bdbf1c98c313620c7dae310091bd0461\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"27076f84093b58d128a0df7300fcdc9c5d0c70e9a3ed9dc582f2afafcbb10418\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73e29825258c01cda83047eeec9c43a2d5dc72122f0a5953b06ebf240dc25577\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"809d465c4078d5e7d05d0181101e1d927b33fb8a05a16c9cd22f4fc5e693c7e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d51b49a426f771721c7eefd4e5b1a3caf7b1d247837181e4bc089c073ab4efa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"eff843e30cb72d79fc66857d109d36d3ae9b0f157785bb4b32af8fafcc0b42ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac94984a86315b01b53eb979b91d6a935d4a0595ba64c3e704ca668c2eebd1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"94f92c74b4fe0f148af8ae85355ef3ff677c1fb7216a1615a16aa6f1e9f5d84a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c3b4ee8c6ae1d51227eb4677de89ed4e77374a9c911529b49097da99db420f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"7472ab8abce66c7b8d69622e4c802f96321d96ae9c53ee487f3f80afe8da41ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68da568b2e0795d31ab1efb5836b88d26dad0f19a22f64fc3b1561586a9e31d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6664a4c2e019c2d31f85421d86baa4fac4c1041a00ae3721bb0b57a8ccbb2f03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b2a036eef771250380a27390d914c74936b69191171b88b607f8b1cf82db8b4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6fe7808d3ab1c5b89345473c0506b3a74b3d1a8735a3a607d065250640b1e086\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bee025f2e728680faa3c9ef656ac14a42b6f3c5c6f5a86558ced027f957a8e2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"06a42d84312769bcee03b258cc4728b6ce013c9a1216dd27757277322728fe3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e2e53c4baab97dcbd1f516cdebfbe4b9d11e490edb40fc490159a76795739a0a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"43d56e7ffacafc951af7e5e172449a6daa8a2e59cd7c60b7eb6ee42e27b86a25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c8126f45a52bcd987e939c23f9da9f433fd35d9c3e5a87e69f5c0830a73ac83\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"7af5bce160eadd58fa4dabf3bcc1733968ee57446e916ad3e1b3d89c3eb6df6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6118ee007d06753619cdd3723e5f364a3646a3c9d99cd0e248a2b041cedc688e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"ae0c5d6228fd93a9b5aa81cf9c846a9343adbd4f82f7085a13f27f7d910fe0c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"93f6801119535020e051e319ff1814709e08eba59d41d11da398d6675db1d33b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"c43b20454038dbfa463db22fa3ec806267111d0d7471710a880d546f9c04b08c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6a5ce3b5e4931a7f21c9b99482f16a36f46eb3341d6754ac80a7a492496aaca3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11bdd2b8a00909c0f187ca67d41d78d206d037a00bec874b5f217240acddcff8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-516871/rate-test-model-516871-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"97c85a3e7546884e5351c01f98f7edc7e3cd479aa9f5d4a86bb7d831c57d42ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-516871/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-516871"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:46.009Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:46.312Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-ad3cbc","namespace":"ai-tenant-e2e-shared-a-w4-ad3cbc","uid":"44b46000-1c1f-4cef-94cb-92172ff72a6d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:46.739Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-test-model-567653","namespace":"ai-tenant-e2e-inf-a-567653","uid":"11092937-7f00-4334-8e8f-9a8f4615e3bf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-test-model-567653\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:46.858Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:47.039Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress","uid":"c0576bfb-3b6c-4444-a906-fbfa45c2a6a8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:47.343Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-567653","namespace":"openshift-ingress","uid":"a2ea4084-c3bb-4bc2-84ad-415ad0bef514","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-567653\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:47.467Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-d48ff4","namespace":"ai-tenant-e2e-shared-b-w4-d48ff4","uid":"6a15a7be-53f9-4911-a88d-412212365926","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:47.910Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-d48ff4-kserve-route","namespace":"ai-tenant-e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-d48ff4-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:47.996Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-ad3cbc-kserve-route","namespace":"ai-tenant-e2e-shared-a-w4-ad3cbc","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-ad3cbc-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:48.077Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-516871-kserve-route","namespace":"ai-tenant-e2e-shared-b-w2-516871","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-516871-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T01:21:48.333Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w2-516871","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w2-516871\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:21:48.423Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"test-model-567653-kserve-route","namespace":"ai-tenant-e2e-inf-a-567653","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"test-model-567653-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:21:56.338Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","HTTPRoute","EnvoyFilter","ConfigMap","Limitador","Gateway","AuthConfig"],"eventTypes":{"delete":67,"update":24}}
{"level":"info","ts":"2026-11-04T01:21:56.741Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:21:58.962Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:21:59.134Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:21:59.134Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:03.238Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:03.249Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:22:03.238Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:22:03.256Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:22:03.261Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:03.261Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:22:03.361Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:22:03.361Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:22:09.415Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-ad3cbc","namespace":"ai-tenant-e2e-shared-a-w4-ad3cbc","uid":"44b46000-1c1f-4cef-94cb-92172ff72a6d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-ad3cbc\" not found"}
{"level":"error","ts":"2026-11-04T01:22:09.625Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-d48ff4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-d48ff4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:22:10.206Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:10.206Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:18.731Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","Limitador","ConfigMap","EnvoyFilter","TokenRateLimitPolicy"],"eventTypes":{"delete":13,"update":61}}
{"level":"info","ts":"2026-11-04T01:22:19.028Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:20Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-238db1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-238db1","reconcileID":"7f70fa0c-ed2e-40df-b340-ffe77e9fd24d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w2-238db1","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:22:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-238db1","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:22:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:22:20Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:22:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:22:21.133Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:22:21Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:22:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-238db1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-238db1","reconcileID":"7f70fa0c-ed2e-40df-b340-ffe77e9fd24d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w2-238db1","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:22:21Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-238db1","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-238db1","reconcileID":"f8af6229-9943-4b92-ac33-56b385e18bf1","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w2-238db1\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:22:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-238db1","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:22:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:22:21Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w2-238db1\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:22:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:22:21.227Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:22:21.227Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:24.914Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:22:24.919Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:24.925Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:24.925Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:24.925Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:22:24.926Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:22:25.078Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:22:27.072Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-238db1","namespace":"openshift-ingress","uid":"95374d3d-91eb-47b7-838d-af9240c64b90","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-238db1\" not found"}
{"level":"error","ts":"2026-11-04T01:22:27.376Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-d48ff4","namespace":"ai-tenant-e2e-shared-b-w4-d48ff4","uid":"6a15a7be-53f9-4911-a88d-412212365926","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:22:28.231Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:28.231Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:22:28.293Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-238db1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-238db1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:22:39.938Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthConfig","Kuadrant","AuthPolicy","Gateway","Limitador","HTTPRoute","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"delete":3,"update":30}}
{"level":"info","ts":"2026-11-04T01:22:40.367Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:40.428Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:43.447Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:22:43.815Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:43.944Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:22:44.115Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:22:44.115Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:47.351Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:22:47.352Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:47.362Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:22:47.423Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:47.423Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:47.433Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:22:47.524Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:22:47.524Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:50.693Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:50.693Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:52.240Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Gateway","AuthPolicy"],"eventTypes":{"create":1,"delete":5}}
{"level":"info","ts":"2026-11-04T01:22:58.140Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:22:58.150Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:58.150Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:22:58.156Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:22:58.156Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:22:58.163Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:22:58.274Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:22:58.274Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:22:58.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/11c6d0a651652f81b1b93abb5a792126b56c88e30da1b18d815362f7b0ce56cb","error":"authconfigs.authorino.kuadrant.io \"11c6d0a651652f81b1b93abb5a792126b56c88e30da1b18d815362f7b0ce56cb\" not found"}
{"level":"error","ts":"2026-11-04T01:22:58.331Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a68a00fbe4ede3c0b38fe9870b558dc6cca1ac15f393e533ce225212342e5576","error":"authconfigs.authorino.kuadrant.io \"a68a00fbe4ede3c0b38fe9870b558dc6cca1ac15f393e533ce225212342e5576\" not found"}
{"level":"error","ts":"2026-11-04T01:22:58.392Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/449ca852af47a1b5a00efc7a8325cd4c05b2d460e01b696fcc011d14e0dab138","error":"authconfigs.authorino.kuadrant.io \"449ca852af47a1b5a00efc7a8325cd4c05b2d460e01b696fcc011d14e0dab138\" not found"}
{"level":"error","ts":"2026-11-04T01:22:58.446Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/63d30fa15f0c2b6c6f5fb22c3e04535e150fe07e2a1261ed59945ab2a4689711","error":"authconfigs.authorino.kuadrant.io \"63d30fa15f0c2b6c6f5fb22c3e04535e150fe07e2a1261ed59945ab2a4689711\" not found"}
{"level":"error","ts":"2026-11-04T01:22:58.527Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/31f0143a60e13ea6745e7fb61bde4910bfe6acd14bb292dc0539b5f33d751f96","error":"authconfigs.authorino.kuadrant.io \"31f0143a60e13ea6745e7fb61bde4910bfe6acd14bb292dc0539b5f33d751f96\" not found"}
{"level":"error","ts":"2026-11-04T01:22:58.614Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b289e3f1befd913bc5c27df0099b83939379105282e4bf360d74f9846054df84","error":"authconfigs.authorino.kuadrant.io \"b289e3f1befd913bc5c27df0099b83939379105282e4bf360d74f9846054df84\" not found"}
{"level":"error","ts":"2026-11-04T01:22:59.330Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-047f21","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:17:48Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"41aa6dc7-fd9c-47f2-93d6-c8025cf52430\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:16Z"}],"name":"kuadrant-e2e-inf-b-047f21","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-047f21","uid":"41aa6dc7-fd9c-47f2-93d6-c8025cf52430"}],"resourceVersion":"141292","uid":"107f97d8-2196-4b09-b0d8-db8ccea12843"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"4d3b12844769d288ee3ca896036c825b5a7163e7b31f6c4263a9fcd4c48a578a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"e0cfe7fffb0aa3094b397c2a23db023872afb5a732e743b4c2d867bd7679135a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"02bf8f8027806842da4d1d3d8f57f43c0cf6a547dd2ba55a94652ccc7b8018b3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"54c925a1fee74830e5a8669286538dda41c1ae1c7f2875ac531e02e1daca9da9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"9f43ce99c5eaf6aec55bff28957556c398e8ecd096a8cd5bceb4b3eac93b78a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"51b334c448fc5ea2c210cdf8733c3ee190a3ad0426b1ab214adc49bd9822f58d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"6a5223ae23ed603062c6014d5f3f5fa3a7aa8a574c0c81f47ba7ebf89fa2eb50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"a70ed70d296dbedd59bcb3f88e9ffa78b1583d1fff1a3b9c8d579c0c088401a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0525c4c0827a4fa7a2054dbb397d0948b85f8ca7bacfc94f5663dd80f43acf2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"731736f274954f42070a1a885b62b46aacba13086865b31d54c2f423668b3b53\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"176c29e780c2eaba3e3b683539283dbdaa8a7665da1387cdc4723b51a1d9c65b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"e19cea8e5adf9dc683d291f9c795375f7eac7f4cb46fded34748a6d63d7b45b4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"480714bb8f307852512911bb73a7a26683803e376f0b44f0f227825cd8f8b434\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"61a6ae6895d13a67e123363adbee3a4e1a8565c8dfe16bbcff34648f2dbd8a34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"3c6658e781631113d28de9a0cb9236f2583c53fd04824374c14d80f33562c6f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"d98398700c360a5b428c7f4c578ba075444a74ee829feb2e8abd052fa6934fac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"c897ab530253a27d5288307b3e424332dd5394081fc64ca973a16fb6809b4b86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"972e26c338c6bbaf2d6b00e7341917cdebee58e6f7538e5676988eb9d27b7eb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"3b6796f2c0d93432094451e5c1e49ad61fa9e5c868dc783c687ddedcfb30a6ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"bb86083e4eb85f183a6ec5d48b076eb39b7ee7621df57ef7cf7eba43e1b04596\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-b-047f21/test-model-047f21')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5369fb14b4c9747fff329b6d22b318dd96b34aaaf0bd9f2df40bf15e7f913b79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"d163e3528bca5c6ec3b38b1456f4954a1629aa74c70340eabdc3c1032e4870c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b32e3e3179c8a47858f894ead7a8edda326b68ece2835880b4e91d10a2e5ef21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"20bc9de53bbbb54bcc22326d899764888ce871183d0e4f2f7e839ebc2618cdb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"966a3b89b25f42fa12afb1fa01a22d057abc3a21a8ec51e3d0f3c83c63e49d9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"0f49ffe44f2a7ea94716bbd9f932ea3b75cefc633dc7edf36b92fb54d485d2f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab7f9daf61f4b9a1a0524772716f8d4e8cc444346633083f3bbe60224de5b5da\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"15e495cb76331be1871831d6cd7a3bfd2763cdbd85b016277d6e3c0e91bc15c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72b09fbd9717a531761117e8a137c042ea24289b5ac302a96ee4aecedbe123ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"0b53a0a51f013fe565ccba1c8c082dc2ab58cbfc6228672d4295281ea5323df3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_10000_per_1m__61f2c3df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1d07b09a86d56cb7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-inf-b-047f21/maas-trlp-test-model-047f21\"]}],\"name\":\"3861b2b53b529934f41dfdcd7ee1dee9f1d5a7d630d60c94a056a7ad761114a8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-b-047f21/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-047f21"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-047f21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:22:59.800Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:24Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4822deea-cfc7-4012-8bab-7aa664065e4f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:30Z"}],"name":"kuadrant-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}],"resourceVersion":"143514","uid":"2cb81ab4-d10b-47fd-8ee0-a5914960e25e"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"8d6421b06578687c7ef644a0fe88cfb38e0608890db5ac6c5a6d9f4f8dc90481\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"a761ad19fdc382d53087898e929beafd8f0790b442221e9f239ea6a434b439c5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"455e048b6a1946fb9947da63c3f8d59e6d34e3488858e59298d5a7d3bea4cd98\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"7887a43b7ae5a8d62d604e5154127b44619058c191f88b4194e6f09d4f61299b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"2e79a7d9837a9c856545b5f91a2b4656e646a902c600154dd1b70aae6b212783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"ae29fbd03447db865e3a34c5892d686117686936f6b3ba2d709b66d0e1262277\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"22a4b46e48633463c1b8972f22694ba96e54eeda51a9f8f0773979b73d850a0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"b9582a40db1dd463eb82d69dbd7f7bc26ac73cfb0a3fcec8766e386a4bfddaeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"a8145813a9b56dc34ed50dd81fc379ed19f75a26ecc67269c54fb433b09cd1a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1b2b8e85d76ff0d584379811211b4148b06ec73c74a836375102374954363d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"28a89dada33d49cd8992e7f35318e96c39560b09cfc58c082359f5e87e4f97b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"617041f6163f04acf5be2ee3a6a363ac1bc3ddf062941091d28338085032c7e7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"4eae637e0ab62992e32fe2e681e6a1d9270776a9f954a42156aea6c738d6f33a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"81d6009326dd8ee3649b6ac7ce6e5056815fb8e71ab61385e3baf97696221392\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"8ef6638e06a317f52df937c0b7122657de5f72505fcdecc529ae4b2cf4150d8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"495f508b4ebccd223482b69eb03259ed3f378858a1214a16d638acf9d64861c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"1069a236aa8747a14b4992df655c29dbc39d320a3a9284bd49a02776379bb00d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e8814ec0bcabc1d155178b62b9f706a82456863dc9d4a57fd217c25b8fbe52df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"b45b8c08a1830940e4927264ca1a60ed34fb3c9356f2e1f7fd9a58f96ee1f953\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91289812b821ff7cf3d67f16d28e61df5c68d710829fec0f0e316503740bf5a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"6a65cc6feea85f27d35640f9bd6857abffa424c8deee32e8614534a6986334fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f06990fed67aa4e3cdcc906e61d569d1d21161a2dbc6c35f085ca529b3d2251\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"7e7e6a3c40df2c03e1078dca9383c23098dab0192f31bfb474bd27960b091e81\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"307c361ec926214650cb5c2e4bb9dec1e4e8cebd71b651361277deb7e86e1626\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"70b4494195ea6e75441af73b4f66a05c98d1269f57642f590f95fe2a61259379\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"27e710700a9520c20146033207ee7e80e02a212b1fd53006aeb30ee15b136dee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"1200dd0431e234d4f176a66f30ab65fa50f77aaaa2b07e18e20bf563b77099f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3a7e292ed41cccc00138c0668dcf4316413fa3a9288ab3eb15c4acd6c7ebdf0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"f1f3ce9d46b59d1db0b388eb691024846c1b3a0984d752bbf0e089f5f1013788\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"dbd867a3282f4d3f0b2224e9a0a717b6688c4853b976493add937469edc9dfb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"79016ee4b4f966cf6c441f34579ea049f63637553b8193324bae0aa836b2db7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"df2665493c1179abe9d1eb2a996b4ad965011d3b3e7e7451c8f64999ea7e5e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"c8cc7f1ee42f8704cc0aa6fe662e93eb76b065868d0b1ca19a262a9434302ebe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"37694e0fe4a8a4daee6cd09ea67587f3f90a67fba636fb5f0a92fd82ec0cf000\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ff8c0672ab4140ed7e3066eb6858ba9dcc1c48e66a82564c44bc66f885b3cdcf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-d48ff4/sub-test-model-d48ff4-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"cc7b48fb57550ab56f5828b5565a201b7710a52f1274cd6aa8b12b8b47a15da0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-d48ff4/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:22:59.860Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-test-model-047f21","namespace":"ai-tenant-e2e-inf-b-047f21","uid":"3c63f460-1c30-4f9e-9f50-eee4d14ddf81","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-test-model-047f21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:22:59.868Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-d48ff4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-d48ff4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:00.183Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-047f21","namespace":"openshift-ingress","uid":"f9dbbb21-f787-46f5-b60e-33b6a5255123","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-047f21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:00.805Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:23:01.433Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:01.433Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:23:01.683Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"test-model-047f21-kserve-route","namespace":"ai-tenant-e2e-inf-b-047f21","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"test-model-047f21-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:01.813Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-d48ff4-kserve-route","namespace":"ai-tenant-e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-d48ff4-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:02.134Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-ad3cbc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-ad3cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:23:09.742Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","EnvoyFilter","Gateway","AuthPolicy","ConfigMap","HTTPRoute","AuthConfig"],"eventTypes":{"create":2,"delete":7,"update":11}}
{"level":"info","ts":"2026-11-04T01:23:10.159Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:12.339Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:23:12.560Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:23:12.560Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:23:16.048Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:23:16.118Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:16.129Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:16.129Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:23:16.135Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:23:16.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:23:16.310Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:23:18.926Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-567653-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-567653-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:23:19.664Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:19.664Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:23:31.201Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","HTTPRoute","ConfigMap","AuthPolicy","Limitador","AuthConfig"],"eventTypes":{"delete":12,"update":12}}
{"level":"info","ts":"2026-11-04T01:23:31.552Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:33.318Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:23:33.534Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:23:33.535Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:23:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-516871","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-516871","reconcileID":"31802fc4-34fe-4d46-8d70-05c6d6e8d796","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w2-516871","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:23:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-516871","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:23:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:23:35Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:23:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:23:35Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:23:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-516871","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-516871","reconcileID":"31802fc4-34fe-4d46-8d70-05c6d6e8d796","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w2-516871","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:23:36Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-516871","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-516871","reconcileID":"245d97f8-df84-4a88-ad5d-7dbfb1a6df75","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w2-516871\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:23:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-516871","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:23:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:23:36Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w2-516871\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:23:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:23:36.736Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:23:36.744Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:36.754Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:23:36.756Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:23:36.837Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:36.837Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:23:36.859Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:23:36.859Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:23:42.048Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\" not found"}
{"level":"error","ts":"2026-11-04T01:23:42.899Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-a4fac5","namespace":"ai-tenant-e2e-shared-a-w3-a4fac5","uid":"69b6274f-211a-47bc-8486-705862fd8347","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-a4fac5\" not found"}
{"level":"info","ts":"2026-11-04T01:23:42.899Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:42.899Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:23:43.732Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w2-516871","error":"gateways.gateway.networking.k8s.io \"e2e-shared-b-w2-516871\" not found"}
{"level":"info","ts":"2026-11-04T01:23:44.421Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"delete":1,"update":2}}
{"level":"info","ts":"2026-11-04T01:23:49.541Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:23:49.541Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:49.550Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:23:49.560Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:23:49.560Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:23:49.655Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:23:49.655Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:23:49.659Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-4"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:05Z"}],"name":"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269","namespace":"kuadrant-system","resourceVersion":"144354","uid":"201d88fb-88b4-417d-862c-e0df82510360"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:49.724Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:15Z"}],"name":"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100","namespace":"kuadrant-system","resourceVersion":"141261","uid":"ca2a455f-5534-4e85-b98f-c25267f536fc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:49.790Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:18:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:04Z"}],"name":"61de55b7272c67cd0d24205d60ef2ef788c198185da35d66bd25bdce26104af1","namespace":"kuadrant-system","resourceVersion":"142906","uid":"5e86a435-e134-48ac-ab6b-906e404a189b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["61de55b7272c67cd0d24205d60ef2ef788c198185da35d66bd25bdce26104af1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["61de55b7272c67cd0d24205d60ef2ef788c198185da35d66bd25bdce26104af1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"61de55b7272c67cd0d24205d60ef2ef788c198185da35d66bd25bdce26104af1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:49.913Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T01:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:59Z"}],"name":"55e4bc2f59571e614704d8d410615c707576eac1dbb9cefb1ecc61d2096371a3","namespace":"kuadrant-system","resourceVersion":"142479","uid":"785f5324-42a7-4f0e-a402-1341a1122534"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["55e4bc2f59571e614704d8d410615c707576eac1dbb9cefb1ecc61d2096371a3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["55e4bc2f59571e614704d8d410615c707576eac1dbb9cefb1ecc61d2096371a3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"55e4bc2f59571e614704d8d410615c707576eac1dbb9cefb1ecc61d2096371a3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:49.980Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T01:20:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:06Z"}],"name":"0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346","namespace":"kuadrant-system","resourceVersion":"144403","uid":"e6cd0066-79d4-4bed-993f-345dd7ada523"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.045Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-6"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:18Z"}],"name":"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3","namespace":"kuadrant-system","resourceVersion":"141409","uid":"4e57a39f-136b-4d7e-93ea-d7605100d540"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.110Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T01:19:15Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:15Z"}],"name":"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7","namespace":"kuadrant-system","resourceVersion":"141286","uid":"2dd7ab8e-c90f-4026-9a20-42bcf5d40244"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.176Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-1"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:17Z"}],"name":"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995","namespace":"kuadrant-system","resourceVersion":"141345","uid":"d507ad55-2556-459d-800d-367eaddc1ae5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.241Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T01:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:06Z"}],"name":"0d1fd44853d54152ef645607885005755fe1dc47104aef14e89790a6f7e8bd8c","namespace":"kuadrant-system","resourceVersion":"142972","uid":"b11de3cb-a0ba-47e7-9049-3420ba5830dc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0d1fd44853d54152ef645607885005755fe1dc47104aef14e89790a6f7e8bd8c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0d1fd44853d54152ef645607885005755fe1dc47104aef14e89790a6f7e8bd8c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0d1fd44853d54152ef645607885005755fe1dc47104aef14e89790a6f7e8bd8c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.307Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T01:19:15Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:20Z"}],"name":"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9","namespace":"kuadrant-system","resourceVersion":"141512","uid":"56e2ecca-508b-4fca-80bc-addb0d7f7381"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.361Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-567653","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:14:46Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:32Z"}],"name":"kuadrant-e2e-inf-a-567653","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-567653","uid":"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4"}],"resourceVersion":"143563","uid":"88d15361-4538-4067-a295-10eac23868b7"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"7a464ef9ab6a4e807ef6453fd2cca0bd0dcbd605c836b6a068a16ff289505d5a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"cd5092683273efc9431833eedef34efcb62a5c43463dcce3dc9fee55aefa712a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"e7fe8a923fd511b559bb25ab3cf3ea4e9bf138ae8d76edafb05b7b5c40bd6d03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"4188fb0dc9ece2a5759c276f2daeffc7e035159b820ed2acded71ad02ca02161\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"2d3f1d7d82d384117ff72d69e4b1d29343ce9951a2f78bdd15261ab2cd32f4b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"5b09c64ba50c301b74e83debe623de502a5f5d0c19fb68f4a990fc93502e0597\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"a39e74ddab347d8ea71b7410ff253c056b462ef3653d578b1c19ae20ec1b7c1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"e5e65a84864d98c65f00b26f4b5242a8f770672db5d962600cd902e1e256773b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"0b1a56521a0c26caf235871aedb602b5e8ec34d357cfb5bb798739db3047de74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"77b558817b8449256a10bef565a9f198782f74ed89b684f15ee32711fc4024a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"8b520257c496ea4fd6dc57e8aafd96a5d4f480d07214b9eeac46c2a0bf6c1182\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"3892e12b6d49759143234e20e4266c21b56ac13e325f28042ed865f8165dc673\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"4a4982ac57138aa21be8768053ea4b0c87eb19d4c2208497b48311e0c64d14fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"59843c32c3a7620b0e11b75bf3e41573684a47a7eced56b076841142b77365eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"02ae347d6cfde776ed074d8d34839bbdbd9abf37ec62a9fee05d88a9d480f38d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"abdbb2b6dbf72730a51659bb8d10df4db4b3800b156128e26017899aa817b420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"5f241107e79a1d2ae1b9667fbaf3d45cf23ba11cc11a681259bd7fcb8fe7e0b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"ced0afc84cfa49bcec48eb13dba447cf0b029476d7e527e2199dcdd94d7c67c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"08d1152a95c976913421b236410d0074ae88a050c4be81772dff1cc8d06c13a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-inf-a-567653/test-model-567653')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"5eced2745940640ce546e289f8794270a15642dd276b93577c3de730b4c6382f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"aaef5613c6cb1087de33139be37421ba4d698b456be39014dd402b24437f09a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"64bd01c13d26bc3e567f123ecf2f8183f58e588bb3c05cbf5bc07047e08343e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"6d4943470a0993df71ccd3c155e0dc41fccb2eb62830f9abeb2b635e3f12329f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"89b769ee6e98227227bd288da26910ca294c4e62a32888de7fe4577fb38a24b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"9e257201f64bdb599c9b19f0e840bc05fa9f25afc4e67fd3c09e6221ee71ba8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-inf-a-567653/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-567653"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-567653\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.386Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T01:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:00Z"}],"name":"094be1b8675d0854c7d92783e9a607cb4452c3c8e30ba5a10f2f0c474c46efca","namespace":"kuadrant-system","resourceVersion":"142495","uid":"8d2b70e8-1893-49f0-999b-66a88d7e7e1a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["094be1b8675d0854c7d92783e9a607cb4452c3c8e30ba5a10f2f0c474c46efca"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["094be1b8675d0854c7d92783e9a607cb4452c3c8e30ba5a10f2f0c474c46efca"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"094be1b8675d0854c7d92783e9a607cb4452c3c8e30ba5a10f2f0c474c46efca\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.467Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T01:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:03Z"}],"name":"2e21abec55982c208b5566ee69dfaa4a2240574659d4b4d1679e2305df9ce62a","namespace":"kuadrant-system","resourceVersion":"142848","uid":"575a12a3-a666-4660-8920-670c9293f7e2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2e21abec55982c208b5566ee69dfaa4a2240574659d4b4d1679e2305df9ce62a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2e21abec55982c208b5566ee69dfaa4a2240574659d4b4d1679e2305df9ce62a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2e21abec55982c208b5566ee69dfaa4a2240574659d4b4d1679e2305df9ce62a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.534Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T01:18:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:06Z"}],"name":"e0ee5535f920b6aa2431481532fe81c85cc9bb8ae44a576aa54286fa0cbcad44","namespace":"kuadrant-system","resourceVersion":"142974","uid":"3d5fa09d-cb2f-44c5-aa61-5bcb9b5da119"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e0ee5535f920b6aa2431481532fe81c85cc9bb8ae44a576aa54286fa0cbcad44"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e0ee5535f920b6aa2431481532fe81c85cc9bb8ae44a576aa54286fa0cbcad44"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e0ee5535f920b6aa2431481532fe81c85cc9bb8ae44a576aa54286fa0cbcad44\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.566Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-516871","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:58Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"59262430-a65d-4fb9-8082-a5ebbf86b6f6\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"}],"name":"kuadrant-e2e-shared-b-w2-516871","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-516871","uid":"59262430-a65d-4fb9-8082-a5ebbf86b6f6"}],"resourceVersion":"144305","uid":"f7839c9e-8ba0-49f2-b1b3-fba72e0e34b1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"b0bdf1559fb724e46b834693961ac80012ba18b84f1f7e761830354d69b6c20f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6118ee007d06753619cdd3723e5f364a3646a3c9d99cd0e248a2b041cedc688e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"ae0c5d6228fd93a9b5aa81cf9c846a9343adbd4f82f7085a13f27f7d910fe0c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"93f6801119535020e051e319ff1814709e08eba59d41d11da398d6675db1d33b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"c43b20454038dbfa463db22fa3ec806267111d0d7471710a880d546f9c04b08c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-516871-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5b4e8785\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-516871\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-516871\"]}],\"name\":\"6a5ce3b5e4931a7f21c9b99482f16a36f46eb3341d6754ac80a7a492496aaca3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-516871"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-516871\" not found"}
{"level":"error","ts":"2026-11-04T01:23:50.600Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T01:19:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:15Z"}],"name":"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb","namespace":"kuadrant-system","resourceVersion":"141289","uid":"7d5131e2-4381-4654-8619-952c2679534f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.665Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T01:20:16Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:07Z"}],"name":"ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117","namespace":"kuadrant-system","resourceVersion":"144436","uid":"3cb09c94-46be-4e40-8b47-4f49f0e7a644"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.730Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T01:19:14Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:18Z"}],"name":"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16","namespace":"kuadrant-system","resourceVersion":"141402","uid":"959acf43-8330-4365-b328-2fb871e76be8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.795Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T01:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:03Z"}],"name":"8db0db96646bb38fe64a5ae619c309131dabd03a0d9480bcee7ceb6e63591526","namespace":"kuadrant-system","resourceVersion":"142806","uid":"b1b8fa34-ae20-4117-90dd-7c93a25cf7d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8db0db96646bb38fe64a5ae619c309131dabd03a0d9480bcee7ceb6e63591526"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8db0db96646bb38fe64a5ae619c309131dabd03a0d9480bcee7ceb6e63591526"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8db0db96646bb38fe64a5ae619c309131dabd03a0d9480bcee7ceb6e63591526\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.862Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T01:20:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:06Z"}],"name":"f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11","namespace":"kuadrant-system","resourceVersion":"144397","uid":"dc993562-53ef-43ee-943c-389b7bb99245"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.927Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:20:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:07Z"}],"name":"99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a","namespace":"kuadrant-system","resourceVersion":"144415","uid":"c83d09e6-280f-45ea-ba2b-b756d8862bf1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:50.993Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-4"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:00Z"}],"name":"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2","namespace":"kuadrant-system","resourceVersion":"142522","uid":"2c962c20-a86b-4942-82ac-412ef1bc6262"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.058Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-2"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:17Z"}],"name":"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1","namespace":"kuadrant-system","resourceVersion":"141338","uid":"bedfa101-faa4-4a9b-b3d8-f82d50554fac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.125Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T01:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:01Z"}],"name":"aef3cf8d0b74f5d310b7c6d7e37cf57d399f96535f78d0adc708957b4abe8b4a","namespace":"kuadrant-system","resourceVersion":"142615","uid":"a6c01b11-29ab-4145-9f12-f68b7a78216e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aef3cf8d0b74f5d310b7c6d7e37cf57d399f96535f78d0adc708957b4abe8b4a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aef3cf8d0b74f5d310b7c6d7e37cf57d399f96535f78d0adc708957b4abe8b4a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aef3cf8d0b74f5d310b7c6d7e37cf57d399f96535f78d0adc708957b4abe8b4a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.190Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T01:20:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:07Z"}],"name":"141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450","namespace":"kuadrant-system","resourceVersion":"144431","uid":"3559926c-5428-40ac-a660-6405e04fdd51"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.257Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:19Z"}],"name":"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1","namespace":"kuadrant-system","resourceVersion":"141435","uid":"d2791765-a223-4f36-a5a0-464fb6635fb0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.324Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:20:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"}],"name":"5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5","namespace":"kuadrant-system","resourceVersion":"144294","uid":"d4b93df5-7c71-4e9a-be99-22ee8c253f9c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.391Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:19Z"}],"name":"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43","namespace":"kuadrant-system","resourceVersion":"141430","uid":"3f2d7ef5-b8c6-4123-b586-e87a2946a337"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.458Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T01:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:05Z"}],"name":"560c179c7cc53cbe44cdc99d255430893d0c63904384c18fc150123a601f346c","namespace":"kuadrant-system","resourceVersion":"142937","uid":"a47f05f1-64d8-4e86-b496-3cf4e6f75c94"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["560c179c7cc53cbe44cdc99d255430893d0c63904384c18fc150123a601f346c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["560c179c7cc53cbe44cdc99d255430893d0c63904384c18fc150123a601f346c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"560c179c7cc53cbe44cdc99d255430893d0c63904384c18fc150123a601f346c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.523Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-6"},"creationTimestamp":"2026-11-04T00:41:55Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:05Z"}],"name":"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec","namespace":"kuadrant-system","resourceVersion":"142958","uid":"c097874a-48ed-425f-982b-8374644feac3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.588Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T01:20:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:07Z"}],"name":"b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8","namespace":"kuadrant-system","resourceVersion":"144451","uid":"2b1f8c44-4877-454b-ac21-9eeedc03790d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.654Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T01:20:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:03Z"}],"name":"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776","namespace":"kuadrant-system","resourceVersion":"144262","uid":"736c2d9e-8370-46fe-bb54-54c5e11e23a0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.721Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-5"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:05Z"}],"name":"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4","namespace":"kuadrant-system","resourceVersion":"144325","uid":"c58946c0-cfce-4bba-b385-8a41c2b389ef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:50:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:50:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.786Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T01:20:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:04Z"}],"name":"819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf","namespace":"kuadrant-system","resourceVersion":"144286","uid":"4d2e057b-6176-453d-afd0-890466872bfa"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:22:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:22:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.852Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T01:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:01Z"}],"name":"fee6db2e1fc190126cdda2651161a7d06dc782d57bfa4296d9af134956c60594","namespace":"kuadrant-system","resourceVersion":"142590","uid":"42284f49-821f-4f59-8c7e-3644655d324b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fee6db2e1fc190126cdda2651161a7d06dc782d57bfa4296d9af134956c60594"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fee6db2e1fc190126cdda2651161a7d06dc782d57bfa4296d9af134956c60594"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fee6db2e1fc190126cdda2651161a7d06dc782d57bfa4296d9af134956c60594\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.918Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-3"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:03Z"}],"name":"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031","namespace":"kuadrant-system","resourceVersion":"144275","uid":"ffe39315-1b74-4d89-96a6-3e9ceddb9fa7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:51.984Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-5"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:04Z"}],"name":"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac","namespace":"kuadrant-system","resourceVersion":"142903","uid":"8559c22c-05ea-48dd-8249-146f081a99e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.050Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-6"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:06Z"}],"name":"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a","namespace":"kuadrant-system","resourceVersion":"144382","uid":"469b6757-a23e-4587-b27b-dbc4a05a8f65"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.116Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:58Z"}],"name":"ca2343d1b5ab18fe82d0c145979b33ecf8598c1d1aac60172c8d284ad3e37de4","namespace":"kuadrant-system","resourceVersion":"142429","uid":"4f20da98-9668-4ef6-b036-6d4ef844d59b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ca2343d1b5ab18fe82d0c145979b33ecf8598c1d1aac60172c8d284ad3e37de4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ca2343d1b5ab18fe82d0c145979b33ecf8598c1d1aac60172c8d284ad3e37de4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ca2343d1b5ab18fe82d0c145979b33ecf8598c1d1aac60172c8d284ad3e37de4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.181Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-2"},"creationTimestamp":"2026-11-04T00:41:55Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:59Z"}],"name":"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d","namespace":"kuadrant-system","resourceVersion":"142471","uid":"ad017b8b-d2d9-4883-b9ff-12273ea4ce74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.248Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:19:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:17Z"}],"name":"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a","namespace":"kuadrant-system","resourceVersion":"141366","uid":"a94ae380-23fe-4ace-94b4-ef2e33cd42b5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.313Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-5"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:18Z"}],"name":"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da","namespace":"kuadrant-system","resourceVersion":"141388","uid":"966d1504-e68c-4923-9a96-7cb055586ea5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.380Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-3"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:04Z"}],"name":"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908","namespace":"kuadrant-system","resourceVersion":"142885","uid":"3b79844d-57b8-440a-a3bd-feecbc0c50c2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:41:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.446Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-2"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:07Z"}],"name":"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba","namespace":"kuadrant-system","resourceVersion":"144425","uid":"13c19c32-a05b-45ad-b342-51985f50b059"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.511Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T01:20:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"}],"name":"3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be","namespace":"kuadrant-system","resourceVersion":"144308","uid":"989a3e9f-57fd-4072-85e5-04da480ddc9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.577Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T01:19:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:16Z"}],"name":"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10","namespace":"kuadrant-system","resourceVersion":"141302","uid":"273d9374-f094-474e-80ee-d65c2bdf9b27"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.642Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-4"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:15Z"}],"name":"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b","namespace":"kuadrant-system","resourceVersion":"141279","uid":"fdfa1b7b-f8ca-4151-add1-e0f21e430f97"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.708Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5#rule-1"},"creationTimestamp":"2026-11-04T00:41:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:01Z"}],"name":"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb","namespace":"kuadrant-system","resourceVersion":"142604","uid":"074658b5-7e74-475c-90a1-7c854767056e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:48:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.773Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:18Z"}],"name":"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9","namespace":"kuadrant-system","resourceVersion":"141415","uid":"90a5d52d-8433-46d8-8d5c-2f9ca55f0c29"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.840Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T01:20:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:05Z"}],"name":"d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e","namespace":"kuadrant-system","resourceVersion":"144357","uid":"c0b2a3d0-ada0-4909-b669-a7d0c9b0c483"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:22:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:22:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.906Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T01:19:14Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:15Z"}],"name":"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9","namespace":"kuadrant-system","resourceVersion":"141283","uid":"8ec2d272-10e7-4175-b66e-85ce1f83a58d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:52.972Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-a4fac5/rate-test-model-a4fac5-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T01:18:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:21:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:21:00Z"}],"name":"150512874489dd62fd0423b7f033f1a3c304e8050ed2938277c8a94fd4f5ec13","namespace":"kuadrant-system","resourceVersion":"142502","uid":"c76bf81d-e423-467b-a9bc-d9851108af6d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["150512874489dd62fd0423b7f033f1a3c304e8050ed2938277c8a94fd4f5ec13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-a4fac5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:18:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:18:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["150512874489dd62fd0423b7f033f1a3c304e8050ed2938277c8a94fd4f5ec13"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"150512874489dd62fd0423b7f033f1a3c304e8050ed2938277c8a94fd4f5ec13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:53.037Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576#rule-1"},"creationTimestamp":"2026-11-04T00:43:52Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"}],"name":"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725","namespace":"kuadrant-system","resourceVersion":"144289","uid":"e8d8581b-f114-4841-ba9b-ee605bcf708e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:43:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:53.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T01:20:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"}],"name":"fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8","namespace":"kuadrant-system","resourceVersion":"144323","uid":"9bcd14dc-1fa7-4e89-a4b1-c4904fc057fc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-e89576.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:22:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:22:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:53.171Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-567653/test-model-567653-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:19:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:19Z"}],"name":"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a","namespace":"kuadrant-system","resourceVersion":"141451","uid":"71e7f37f-68e5-49d2-9455-772a600eabc9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:19:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:53.237Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653#rule-3"},"creationTimestamp":"2026-11-04T01:14:45Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:20:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:20:18Z"}],"name":"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c","namespace":"kuadrant-system","resourceVersion":"141384","uid":"ad50fc20-656e-4975-8548-130209391de5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-567653.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:14:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:53.306Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-567653-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-567653-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:53.684Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-567653","namespace":"openshift-ingress","uid":"a2ea4084-c3bb-4bc2-84ad-415ad0bef514","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-567653\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:53.699Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-516871-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-b-w2-516871-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:23:53.863Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-e89576","namespace":"ai-tenant-e2e-shared-b-w3-e89576","uid":"54f3e431-d1f2-46fa-a7c4-36e175090ced","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-e89576\" not found"}
{"level":"error","ts":"2026-11-04T01:23:54.072Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-e89576-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-e89576-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:54.105Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-516871","namespace":"openshift-ingress","uid":"0faf531d-9aed-4af0-8117-1b980184e8c7","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-516871\" not found"}
{"level":"error","ts":"2026-11-04T01:23:54.230Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-a4fac5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-a4fac5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:54.719Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-a4fac5","namespace":"ai-tenant-e2e-shared-a-w3-a4fac5","uid":"69b6274f-211a-47bc-8486-705862fd8347","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-a4fac5\" not found"}
{"level":"error","ts":"2026-11-04T01:23:55.155Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w2-516871","error":"gateways.gateway.networking.k8s.io \"e2e-shared-b-w2-516871\" not found"}
{"level":"error","ts":"2026-11-04T01:23:55.333Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"test-model-567653-kserve-route","namespace":"ai-tenant-e2e-inf-a-567653","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"test-model-567653-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:23:55.893Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","reconcileID":"ed065ed6-e5b0-4342-be18-d267d01b19e8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","reconcileID":"ed065ed6-e5b0-4342-be18-d267d01b19e8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-ad3cbc","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w4-ad3cbc\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:24:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:24:06.714Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","Limitador","AuthPolicy","Gateway","ConfigMap","Kuadrant","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":13,"update":66}}
{"level":"info","ts":"2026-11-04T01:24:07.017Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:07.037Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:09.443Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:24:09.917Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:24:09.951Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:24:10.052Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:24:10.052Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:24:12.659Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:24:12.663Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:12.714Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:24:12.718Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:24:12.719Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:12.719Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:24:12.784Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:24:14.590Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-ad3cbc","envoyfilter":"openshift-ingress/kuadrant-e2e-shared-a-w4-ad3cbc","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-ad3cbc\" not found"}
{"level":"error","ts":"2026-11-04T01:24:21.724Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-ad3cbc-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-w4-ad3cbc-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:24:22.027Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-test-model-047f21","namespace":"ai-tenant-e2e-inf-b-047f21","uid":"3c63f460-1c30-4f9e-9f50-eee4d14ddf81","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-test-model-047f21\" not found"}
{"level":"error","ts":"2026-11-04T01:24:22.432Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\" not found"}
{"level":"info","ts":"2026-11-04T01:24:23.040Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:23.040Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:24:23.100Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:23.115Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-e89576-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-e89576","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-e89576-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T01:24:23.766Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-ad3cbc","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-ad3cbc\" not found"}
{"level":"info","ts":"2026-11-04T01:24:24.273Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","AuthPolicy","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":3}}
{"level":"info","ts":"2026-11-04T01:24:24.442Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:24.460Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","reconcileID":"927f3dbe-521e-4731-b858-dc83e1781a13","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:24:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:24:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:24:25Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:24:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:24:25Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:24:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","reconcileID":"927f3dbe-521e-4731-b858-dc83e1781a13","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:24:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-a4fac5","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:24:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:24:26Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w3-a4fac5\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:24:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:24:26Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w2-58b06e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-58b06e","reconcileID":"0cc15cab-892a-4393-9cca-2d841b3c8063","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w2-58b06e","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:24:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-58b06e","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:24:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:24:26Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:24:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:24:27Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:24:27Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w2-58b06e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-58b06e","reconcileID":"0cc15cab-892a-4393-9cca-2d841b3c8063","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w2-58b06e","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:24:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-58b06e","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:24:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:24:27Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w2-58b06e\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:24:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:24:27.647Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:24:27.728Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:24:27.743Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:24:27.744Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:24:27.744Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:24:31.458Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:24:31.462Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:31.464Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:24:31.475Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:24:31.535Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-a-w4-ad3cbc","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-w4-ad3cbc\" not found"}
{"level":"error","ts":"2026-11-04T01:24:31.535Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-shared-a-w4-ad3cbc","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-w4-ad3cbc\" not found"}
{"level":"info","ts":"2026-11-04T01:24:31.537Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:31.537Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:24:31.646Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:23:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:26Z"}],"name":"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2","namespace":"kuadrant-system","resourceVersion":"50319","uid":"934f5c73-c54e-403f-b357-adf822772468"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:31.649Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:24:31.650Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:24:31.717Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21#rule-3"},"creationTimestamp":"2026-11-04T01:17:47Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"}],"name":"966a3b89b25f42fa12afb1fa01a22d057abc3a21a8ec51e3d0f3c83c63e49d9c","namespace":"kuadrant-system","resourceVersion":"144292","uid":"07963a72-c891-401d-a015-c64452055f13"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["966a3b89b25f42fa12afb1fa01a22d057abc3a21a8ec51e3d0f3c83c63e49d9c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["966a3b89b25f42fa12afb1fa01a22d057abc3a21a8ec51e3d0f3c83c63e49d9c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"966a3b89b25f42fa12afb1fa01a22d057abc3a21a8ec51e3d0f3c83c63e49d9c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:31.788Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:59Z"}],"name":"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5","namespace":"kuadrant-system","resourceVersion":"49588","uid":"3139ddea-35a8-4abc-ba3c-0ac4107facb6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:31.852Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:12:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:48Z"}],"name":"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451","namespace":"kuadrant-system","resourceVersion":"31556","uid":"5fc1a639-f9e0-47a5-9383-5232894dd926"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:31.919Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:12:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:47Z"}],"name":"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1","namespace":"kuadrant-system","resourceVersion":"31496","uid":"c9fa741d-cf8d-44b7-ab94-f4a7c515c947"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:31.986Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:00Z"}],"name":"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8","namespace":"kuadrant-system","resourceVersion":"49670","uid":"e5aeda31-a0f5-41d4-beac-834ba64a79d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.055Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T01:20:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:07Z"}],"name":"4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7","namespace":"kuadrant-system","resourceVersion":"144412","uid":"5931fe36-5235-4f00-9d3f-ac37e2f0c8e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.122Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:12:54Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:52Z"}],"name":"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22","namespace":"kuadrant-system","resourceVersion":"31700","uid":"543cbd4d-efa3-4870-9277-0c12df543c3d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.135Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:24Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4822deea-cfc7-4012-8bab-7aa664065e4f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:48Z"}],"name":"kuadrant-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}],"resourceVersion":"145382","uid":"2cb81ab4-d10b-47fd-8ee0-a5914960e25e"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"a8145813a9b56dc34ed50dd81fc379ed19f75a26ecc67269c54fb433b09cd1a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"dbd867a3282f4d3f0b2224e9a0a717b6688c4853b976493add937469edc9dfb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"79016ee4b4f966cf6c441f34579ea049f63637553b8193324bae0aa836b2db7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"df2665493c1179abe9d1eb2a996b4ad965011d3b3e7e7451c8f64999ea7e5e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"c8cc7f1ee42f8704cc0aa6fe662e93eb76b065868d0b1ca19a262a9434302ebe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"37694e0fe4a8a4daee6cd09ea67587f3f90a67fba636fb5f0a92fd82ec0cf000\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.190Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:11:59Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:56Z"}],"name":"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec","namespace":"kuadrant-system","resourceVersion":"31851","uid":"c20ca909-75ec-4560-9058-0c4322e9a16f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.255Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:20:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:07Z"}],"name":"ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026","namespace":"kuadrant-system","resourceVersion":"144439","uid":"7f7e041d-58d2-4c16-a2ae-50bbf4fa3b0d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.309Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w3-a4fac5","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:41:56Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"0d9286a3-fc07-43a3-ae3f-1766edb49dd0\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:23:17Z"}],"name":"kuadrant-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w3-a4fac5","uid":"0d9286a3-fc07-43a3-ae3f-1766edb49dd0"}],"resourceVersion":"145883","uid":"b07661a3-d588-443c-b547-70c1165efbf4"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"d21a8dbe4d63c1c76c5803889f0ed2b730249d1b48deb712d825daaa4657aaa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"c9acea04cbf39f2981dd1a245f18178f137cd6d2d7a643adbca92f59a142c153\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"e1d0e1b4476a1281d74748638e5802057df5161cf75b5267cf760ed1152999d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"340368d8ddc2b2ef6abd4fa7792745eac63d8424a90ecb186cc80096c6eb39ef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"1a7c82c7f9d0780636e05434bdf6e53e13e198a50a23623c5f9f6466c79dcea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-a4fac5-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0081cb74\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-a4fac5\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-a4fac5\"]}],\"name\":\"15031e7a1557e38e5db1b74edd83508a08c14602d4fdcd67811e608dfee97daa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w3-a4fac5"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w3-a4fac5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:12:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:42Z"}],"name":"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1","namespace":"kuadrant-system","resourceVersion":"31332","uid":"46cacd50-a50c-4cac-a458-23a629e31a7b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.395Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T01:20:16Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:06Z"}],"name":"55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0","namespace":"kuadrant-system","resourceVersion":"144389","uid":"37ac88f3-2a1c-4494-ab16-34390f10eb5b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.461Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:59Z"}],"name":"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350","namespace":"kuadrant-system","resourceVersion":"49591","uid":"0e482390-0705-4960-a276-acc378549aaa"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:12:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:51Z"}],"name":"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1","namespace":"kuadrant-system","resourceVersion":"31673","uid":"a154f656-4944-411e-9052-17e494d7d02d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.597Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:00Z"}],"name":"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701","namespace":"kuadrant-system","resourceVersion":"49689","uid":"601562f3-3f34-42ab-87c1-c0810b3d3c79"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.706Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:12:07Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:45Z"}],"name":"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329","namespace":"kuadrant-system","resourceVersion":"31431","uid":"f093b68a-920e-4656-a943-53204fc5029c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.765Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-567653","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:14:46Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:23:37Z"}],"name":"kuadrant-e2e-inf-a-567653","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-567653","uid":"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4"}],"resourceVersion":"146302","uid":"88d15361-4538-4067-a295-10eac23868b7"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"0b1a56521a0c26caf235871aedb602b5e8ec34d357cfb5bb798739db3047de74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"5eced2745940640ce546e289f8794270a15642dd276b93577c3de730b4c6382f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"aaef5613c6cb1087de33139be37421ba4d698b456be39014dd402b24437f09a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"64bd01c13d26bc3e567f123ecf2f8183f58e588bb3c05cbf5bc07047e08343e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"6d4943470a0993df71ccd3c155e0dc41fccb2eb62830f9abeb2b635e3f12329f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"89b769ee6e98227227bd288da26910ca294c4e62a32888de7fe4577fb38a24b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-567653"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-567653\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.771Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:23:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:25Z"}],"name":"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6","namespace":"kuadrant-system","resourceVersion":"50310","uid":"223e55b3-2259-43c1-9810-8a23c723c5ac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.838Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e#rule-3"},"creationTimestamp":"2026-11-04T00:11:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:44Z"}],"name":"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf","namespace":"kuadrant-system","resourceVersion":"31405","uid":"1f06f2f0-cac9-43a5-bed1-50809bcfda71"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.874Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-ad3cbc","envoyfilter":"openshift-ingress/kuadrant-e2e-shared-a-w4-ad3cbc","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-ad3cbc\" not found"}
{"level":"error","ts":"2026-11-04T01:24:32.903Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:23:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:25Z"}],"name":"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea","namespace":"kuadrant-system","resourceVersion":"50304","uid":"2d43f3ee-6fed-4cf8-bbf0-4a6948fbc571"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:32.969Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:23:26Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:26Z"}],"name":"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297","namespace":"kuadrant-system","resourceVersion":"50339","uid":"4b730091-434d-4c1f-86c7-6dfa407e9d65"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.035Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:11:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:55Z"}],"name":"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975","namespace":"kuadrant-system","resourceVersion":"31815","uid":"6cb9c94c-b210-4de9-8c12-1222cef2e130"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.100Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e#rule-6"},"creationTimestamp":"2026-11-04T00:11:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:54Z"}],"name":"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af","namespace":"kuadrant-system","resourceVersion":"31773","uid":"4ef9351c-a479-4a86-844d-beb660876941"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.123Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-e89576","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:43:52Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"921550b9-e248-45c0-b3dd-b3c75826bf69\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:23:16Z"}],"name":"kuadrant-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-e89576","uid":"921550b9-e248-45c0-b3dd-b3c75826bf69"}],"resourceVersion":"145861","uid":"d0208b1f-740f-4ca5-984a-09841be9a98b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cecf4b7605fbf7a634fc7b77185b4d7ebd20a144604d11cd3007493370d9b207\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5968065d6dd51fab68e7417285424e21a64ac2973f6bed9828bdd659ed75dec8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"ff38a8dd86d72f9d45f0de09699dfc4b29d6ee8abe6ae64ec71eb55cb6ef3b0f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5bb2cfdd387e9aa87d4d9baf87427f174766e18e8cf38c6b57956550b03c676c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"386502c5dd83df97022073a1e98d64ac59e072b17950191d54d002866028ff7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"a29eb6eb82b8a6d9d1fd9dae787032bef13343b86e0f6b0b34c3cf7f3de7af14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"be28ae124b98fbf7b5572d93f1b0040112082d0b3cdbb1a7a6688b5b8961f224\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"c7fc5d0eed87978dd3b0ff87a901f0bff000b0ce841924bd7655da42456967c5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"3ea848ea7a28ccec66fa770b3af2452b6b0b907146017230150b4eb245cdf478\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"b48f9ffb16488230ccfba7be12fecc14d77ffaa6791fac31cfdf089d3bd9cf19\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"877b5e6c6dc95c57bc96a4d2f0ba86cbcab176b129452b31536b4fdf4d531210\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5b894ed9f23e961b2cf22bae67fb738504c1f61e13fbc6c166efb61c3eca2e4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"51344648a80299e3b222af703676b7a62676f72287aa79688416c859a4c25cfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"dba078fd7ca177486b349b8d338b6ccfef6c1b8961d4726399b7a45f21f9dae5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"f803be84bbeac273c0d64f93aca27674f3c0e7847ca5ced702565c583f4238e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"ae1cf6a82a4436771fc3b0c14d82ec7179cf59fbdb95dce09ed277754037e455\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"6af38bba1645e8ff2c0a6565dfe8c1d12b1b889eb78d44966a52b7db415cceb6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"4f18cd88604b5d76771cb0b3ebb10ba91f9bc3110a51d21d0be4bd9feaaecb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"c147090c7a09ad90ca5c712b319bcc56ce9201f784435f4fc8bc7fd22966b64f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cbb2bfaa3f7807da810e5291128dafdf0ad6a95e35e1e8579ba5c146fe1b92b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"755a0cc7a588e772af9132fcda445bc892a59b574f2f7284b043f1d478444943\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cfbf9c267cd9cb7b63a74fd1748936a93876c7424601b821496ba7463c22e3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5b4bf640448cf71b6adb08f5416cb2f93badffbd5e65a485b88a5db0cb08b40c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"493cb8642d7cbb23499392f14e4d28be76ed3e633c56318221b47ff22efa9714\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-e89576/rate-test-model-e89576-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"8b6481563e46a2c4798f147ec4a643710acc55f443ca552abecbc4c0e50c57ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-e89576/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-e89576"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.165Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:12:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:51Z"}],"name":"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85","namespace":"kuadrant-system","resourceVersion":"31659","uid":"c1f677e7-5a14-4ac1-aa40-3aa423778727"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.230Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:01Z"}],"name":"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f","namespace":"kuadrant-system","resourceVersion":"49744","uid":"376fbab2-9a8a-4408-84b1-98679b1ab6fe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.305Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:12:03Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:53Z"}],"name":"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654","namespace":"kuadrant-system","resourceVersion":"31734","uid":"ede05201-9781-4874-b45b-30cad1464b24"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.430Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:12:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:50Z"}],"name":"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d","namespace":"kuadrant-system","resourceVersion":"31619","uid":"2e55c2fb-3b05-4fdd-bcb7-b4bfec7009d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.430Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-58b06e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":20,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4fcb948c-b646-4a79-81f0-c8c8b238ba80\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:31Z"}],"name":"kuadrant-e2e-worker-w2-58b06e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-58b06e","uid":"4fcb948c-b646-4a79-81f0-c8c8b238ba80"}],"resourceVersion":"83254","uid":"732b86e6-fa81-4635-acf0-7deb37d6eb21"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e146aba91e806fec4ad460501c64f088e7918b3c7df4adc5b88bc6c3faf2ac37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"9dc9d9cec315591800c88f4289e106e101bea3f744c5b9e8db2e7bee888f56d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"63ec76d05da6d8eb8438f4440655f88e11dac33ecc007fa0c01af712b41e570a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"602b24d85c40ef1424ba4360695cdf69f8ff19714c62cbcceab51ed74fdbb3c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"91ef8a3906f365286d0019bcfbefc55ed221a2b34a354423d7e5aabecdfc1e41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fe787d97dad775e52b0925cb3b1fc11a2cccc1c1d01be7803ffa54e7a5c34f04\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7518d66fa47f7f6cabe6c14b9e1911316826c977ac3ad6142125da82716ee49d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dc090a0b1fa64108101227bd0e9b3c7a256183d61df5facdc28601f35312d1b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"2a2f0db09cb2fb6f2f7fb7aae81d3230cdc54b055d10cab642b30512426ad32e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"a264fddac0eede3bb186a56c3d99c2c84f52da822bfe449896c63e80d378fa6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"975ea7be7a86f3bd7fd50267137f6de8065399993c7f63b59c191559e47f793b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"0550d6c99a9c75642299947f71e362196d9b4abf2094d7e3ae1dc4c1153628b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"a95a55523a043ed134414c098458e5a7d6983ab83c6259ae31d9d5fa9a8316c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5cf451c78d8f4be30e60bba48086bdc4cf8200cc3ebdbab4eb91c0d2d9e57068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6118193c4ed945f459e205e00e6416c96e49516833c47b89d6ab4cf069c93dd8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1d7028f009a317db8afd1e93862135d0f18f2de709aa112b26db637814fd6ef1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1369d79269306e5fa8bcaf6aa97220019e84961c9b6a9afc7b7b263f0ecb49b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"2480cdb507fa123566b39943d7f0d47eaddf130eba838a9db19503d4f513a022\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"9bc8ba0637406af8bf8245d440db5a33901d9b4f5074b872b15869bdd6287a09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"2124069b6a0d920b738a13569de3259650e6753b0f67ccee6180a5cae31b4c5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6ace09d0808b0cc3ec8485b92185031610ea8a5f271f1d1b8533399d7cd3c81f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c74893123203fae1ad8050e640815fae46cdb7fde29ebfbefa3b6065bc0b820d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"5c2c66b930801af0fcd5415e60c1646e4cd4d22f4cab4c51bdb2f5aa9db1a342\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7b596cdf84908424c0234d4546947508d061e01a9490fddfb346ada7a88d98d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"567d9ef227a1b0e29d280dbfeb4eacab7843c88000a805f0ef359193c69a8189\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e40f041bd75dbf3b0658d7a49adba76e80113241cee931f90f0c37a1149955ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8713cb237dc57b8e8ced66f8cbc11fc7c18b377af9e36c0138a053141e4df20b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"ce3567b64c376474041ae5a790ea350039c7b065c373d3bc82afe2a18645e225\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8a3503393c3e9bb4af6707deccbd9de501af9ca64c00bce65971025fe6d62c10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"053fe182975a90257bc91bb8a5ba18938a225856a6ec12e179a0dc901e82026c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6ed13fe5de1ff7dedfc61727996ffa62a24b166093c9d75c2f340d2dd813d7cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"dad0c6ed4987ed315608a951935eb320ea90d0b7236754a5f14c216e2672149f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d4fa155ad06444715f5bdd7c86b935b8c3a09c0161684a34c5242e209fd1395e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d255f6849f684d6e9c587b3f81919950ca9931063d04bd20d428877e38cf32bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c831625dbd0f9e3494dc98ae61f4c722e508874473ed5dd3337e4d8b4a5ab8b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"de20c62aecea77c4f5b388cd06473e104621178deb4cf0c778e9e6a0dab0b2b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"0d9d3be3564a3100151a6e1ae1951f13156c7a924c22d306d33ed599169b3a8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"41be2b2d382e17f0d6fb6346c55ba1c2a1df17a426cfc91098af388907da6123\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"6318789fe768d7c7c1bf509753a4278019fd033bf3264acfc3fdfb4736e405a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"550b741ebc8392a9c41d86bad794dfa1dac3e217cf38ae211b94ad3b460cf816\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b5a2bfa9c376e074f9d1a5fc1e74b4b8f2be7b2443cee6dc093b54b277b61812\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d4f9476e079c86438a3e70bf00658c15da54d5affac927aca709f2a5a28a2856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"6d90fbb4b52441d45d1af633f0a5a1c7f4fdaac2beb5a19b805c85ac96e9ced5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b37b3c55782fc38e56fc7c8f891c162219d3ceb3cd7f0a4c2a524ec50e8161da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c5a1feb40731a163ade82e9f405b4d8dd54e59a876cebd6035483ebf43d073ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"5addad89ee48bb5ebc2fff94e068612b169a0543cf684ef8f91e03839a6b46aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"dd4e834b7175a5cf901f9c385d7d10e6783ec3856021a2d78890f5df8fd3d860\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"83d997eaacfd09bfc29a6f839961259fc137d16701d722788b8af24072a60cf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"602faff5ecaf80d48ceedcb6660ff57225a35d1a81dfd16de6c23c17b2c58e1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4fc416c6b94554b03be40292dd34bbe7f23edf74b3de1f2650f9cd17dc8c8dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"2559fbf0028a5ba78bd30825f90d521639e7efcff44897276d57ea397c3521d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"00dd40de0fd03d4c4e442d21a39cc29666a793e485c24257ae6f5865d8dcafeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"93acb8e543c3570b87a029840646c64ab84aba25460ef6fde7be10e83afaefef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"fb609aa5491ba907805d2d8a79e6fd486398e0af827f29290c8550c4de9cc08b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"66a3a3221e645480d16e899f2ee66a0f903d082d098085ea6eb7cea5646a9a4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"1eb7897d87b8324e162e8c157b519a2453ebc40421c65a5fb6b6cf3a99da37bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"47f2d0dad0904e4754a31b56bc3996015000d246a651cd7ae8a0c11a13c46d29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7e1eb9dec290fe93db72581dd65bd5fd27cc167d1e8123fc32d61e49b3882af0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"16ce1f8437f72a646ef479dfa8d9081aab6a8d15639d9a41302d1dcaeb83d480\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8a9aa2912542895fd0b2c1620fbbff56d6354a0244b869584a9421322d58549a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"3dcd0c3947e33253b1421b74217847eed8f5dad1afe3feda1a3f46868bb89d5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"65ca4d1635580c50567fead06bf8ddc00121f26e3c1b0af3588da26caa4031e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"d08fc10d786223e68c46b2831514aa962b8e810b48bce7c290fd5a9dc946e0c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"4652f8a2150a4931901a27c005b2bb44d4d7d1212b652ba25bff4887be9a061d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"afe3e4fd6498dd752c1408d44d697c78067d9cfca49b8e17c957f1107bd29159\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"7b5707c55f4a831b6c40c8de714355dc37f0769f3d01e3ab63089a574a5e90c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"c60828ca16ef84b7a5f682d52ef03cede85f017663e62fb9fbc0ad772dfd2ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"b80f6cef2e969c1f008570634a903912fbb963e02b61fcd3d6eabc96e4d7e660\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"ec22cae50a0d141359a788b23404a1b87020873e849f1c7f2821e4f4f589819f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"8011907f4913a9f005064fa089a9485c460a80b7297b4e7706c2794bced53adb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"ea3f4ea4acf30bd44f150de33dd1c53f56bd31e718ea55da79b359501ae332ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"87ebeaa6eb266e52a2aeeffb20a6bfec05537473569fb827a1c21b7f4278a033\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"fa7d0d6f93c4fe7b3a94fcb94afd6da2ab83b0ea6d135aa71da22c34993718e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"37cdaebbb9459c785c9575c5ac0f286daad6ed4c5aed53dddcc7bc477a218575\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c37f853416f0a9352736127603b1f84bc1be9730f83da4fc8da4e0aedf2c07e8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"aab6da24089d86ef6744750ec37e3ae4ae54a659206c3db678eda83f7331c625\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"e7cdfdfbf54424223419f523f1a4eb07195319bff0df2592a923437be7e0ddf9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"d42d6ef898b5bb2f53c8be14ffeee02d873488450136c9cde9672f67f8b5db65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"c256fd8bd371bcd3200dceaa60a34fd91fbe5b36d1fd2ec991ebc2490e9630a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/simulator-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__3e5a42ec\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f2febebc2da6ae0c\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-58b06e/maas-trlp-premium-w2-58b06e\"]}],\"name\":\"7511c9e343a4a77a350a8f490a05d514a7fb3a7c49cba5959a484dff97a8d826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/premium-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"bdd2a7ea22d1e652493a5199df68b6469e1d56e9f4cecd5730da55663f4ae048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-w2-58b06e')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-58b06e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__c926ea90\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-58b06e\"]}],\"name\":\"66c1d0d7977e242c1ab5ab2e30c9e5d38016fdb4efbc086cfe61f11b43028d1f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-58b06e/models/e2e/distinct-2-w2-58b06e')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-58b06e"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-58b06e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.534Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:12:08Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:49Z"}],"name":"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0","namespace":"kuadrant-system","resourceVersion":"31573","uid":"37245fc9-7c58-4fb0-9356-ba2fb4342d2c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.609Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21#rule-6"},"creationTimestamp":"2026-11-04T01:17:47Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:06Z"}],"name":"e0525c4c0827a4fa7a2054dbb397d0948b85f8ca7bacfc94f5663dd80f43acf2","namespace":"kuadrant-system","resourceVersion":"144400","uid":"6d7e34b2-0a1c-4be9-987a-2cc0abb47f78"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e0525c4c0827a4fa7a2054dbb397d0948b85f8ca7bacfc94f5663dd80f43acf2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e0525c4c0827a4fa7a2054dbb397d0948b85f8ca7bacfc94f5663dd80f43acf2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e0525c4c0827a4fa7a2054dbb397d0948b85f8ca7bacfc94f5663dd80f43acf2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.677Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T01:20:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:06Z"}],"name":"19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694","namespace":"kuadrant-system","resourceVersion":"144380","uid":"2de4774d-c9c5-42b9-83b8-8d7beef85a8d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.744Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:12:04Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:47Z"}],"name":"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644","namespace":"kuadrant-system","resourceVersion":"31488","uid":"eefd1a4a-7e87-4137-a78b-36b9549b265e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.809Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:12:46Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:48Z"}],"name":"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10","namespace":"kuadrant-system","resourceVersion":"31541","uid":"50c27175-1970-4bc1-a6e1-c69bafa419ff"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.874Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T01:20:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:05Z"}],"name":"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0","namespace":"kuadrant-system","resourceVersion":"144363","uid":"f06ea771-f5a4-40f7-b03e-1e81fc8b97f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:22:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:22:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:33.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:12:07Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:47Z"}],"name":"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a","namespace":"kuadrant-system","resourceVersion":"31514","uid":"253a5204-13e1-4dea-8669-f32ae0d5819e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.009Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:23:26Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:26Z"}],"name":"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826","namespace":"kuadrant-system","resourceVersion":"50333","uid":"43034fb9-aece-442a-9800-4b5f4f177f2a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.074Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:12:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:49Z"}],"name":"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c","namespace":"kuadrant-system","resourceVersion":"31599","uid":"38c2b849-3cdb-4731-9e9e-61f3466cc5c4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.141Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:23:26Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:26Z"}],"name":"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82","namespace":"kuadrant-system","resourceVersion":"50344","uid":"ba9b31b3-b524-4755-a01f-e48589aa0d82"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.206Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:11:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:53Z"}],"name":"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8","namespace":"kuadrant-system","resourceVersion":"31754","uid":"b06a468b-855d-4b04-a094-bb3f8505a2cb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.271Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21#rule-2"},"creationTimestamp":"2026-11-04T01:17:47Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:07Z"}],"name":"5369fb14b4c9747fff329b6d22b318dd96b34aaaf0bd9f2df40bf15e7f913b79","namespace":"kuadrant-system","resourceVersion":"144434","uid":"a85e8d3d-fe95-4ada-801a-a52bf70c8c7e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5369fb14b4c9747fff329b6d22b318dd96b34aaaf0bd9f2df40bf15e7f913b79"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5369fb14b4c9747fff329b6d22b318dd96b34aaaf0bd9f2df40bf15e7f913b79"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5369fb14b4c9747fff329b6d22b318dd96b34aaaf0bd9f2df40bf15e7f913b79\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.337Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:59Z"}],"name":"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a","namespace":"kuadrant-system","resourceVersion":"49569","uid":"1a046d8c-a930-472f-90ce-67df8e6cae9a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.404Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:23:26Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:26Z"}],"name":"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11","namespace":"kuadrant-system","resourceVersion":"50324","uid":"6fe145a4-25e7-4b06-8411-0cb7f8937410"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.473Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T01:20:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:05Z"}],"name":"dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929","namespace":"kuadrant-system","resourceVersion":"144351","uid":"f248072d-9365-403e-90e3-d1ea1d6d51be"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:22:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:22:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.538Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T01:20:16Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:06Z"}],"name":"321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c","namespace":"kuadrant-system","resourceVersion":"144405","uid":"e33d1657-1159-4c6b-aff7-b3bc61ed7920"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.603Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:12:44Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:52Z"}],"name":"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6","namespace":"kuadrant-system","resourceVersion":"31705","uid":"c9262da6-10c7-41f2-8768-d7b2e59f6263"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.669Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T01:20:15Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"}],"name":"01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f","namespace":"kuadrant-system","resourceVersion":"144317","uid":"38134e9f-7295-4ead-a6d5-798abb7471e6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:22:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:22:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.734Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:12:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:41Z"}],"name":"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8","namespace":"kuadrant-system","resourceVersion":"31321","uid":"ef13218f-8a7d-4101-8fde-ba23e5ef0021"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:41Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:41Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.801Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T01:20:16Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:08Z"}],"name":"29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87","namespace":"kuadrant-system","resourceVersion":"144457","uid":"de8ca882-2497-4062-a132-1eac0255eeec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.867Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T01:20:15Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:05Z"}],"name":"eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2","namespace":"kuadrant-system","resourceVersion":"144360","uid":"447e7f99-6ad6-4c4f-a591-e15e86384551"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:34.945Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T01:20:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:07Z"}],"name":"4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca","namespace":"kuadrant-system","resourceVersion":"144442","uid":"5714aff5-1e2f-493b-88f9-ceafc9e670f0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.013Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:12:03Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:48Z"}],"name":"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67","namespace":"kuadrant-system","resourceVersion":"31535","uid":"4ed97533-97a0-4403-b8b8-0160a316305b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.078Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:23:26Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:26Z"}],"name":"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016","namespace":"kuadrant-system","resourceVersion":"50338","uid":"6f1e54d9-7096-402a-a001-e06dd90776af"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.144Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:23:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:25Z"}],"name":"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9","namespace":"kuadrant-system","resourceVersion":"50308","uid":"47bc8e1e-9e03-43ab-80d2-aba006536f56"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.209Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:12:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:56Z"}],"name":"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b","namespace":"kuadrant-system","resourceVersion":"31862","uid":"1f96f2d4-1fac-4242-88a6-977b1cb937ca"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.275Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:59Z"}],"name":"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1","namespace":"kuadrant-system","resourceVersion":"49576","uid":"cf344750-5656-449a-96a4-69cb2f149a04"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.340Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/simulator-w2-58b06e-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:11:54Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:46Z"}],"name":"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc","namespace":"kuadrant-system","resourceVersion":"31471","uid":"83a5418b-4fa3-45ee-b8c7-68426ee68e81"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.405Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e#rule-4"},"creationTimestamp":"2026-11-04T00:11:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:53Z"}],"name":"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a","namespace":"kuadrant-system","resourceVersion":"31758","uid":"8548bf0c-dd45-454f-9ee6-031f8a008763"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.469Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e#rule-2"},"creationTimestamp":"2026-11-04T00:10:54Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:47Z"}],"name":"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9","namespace":"kuadrant-system","resourceVersion":"31510","uid":"e00a7d86-4e58-49aa-8f66-4a7aacc7475c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.536Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21#rule-1"},"creationTimestamp":"2026-11-04T01:17:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:06Z"}],"name":"72b09fbd9717a531761117e8a137c042ea24289b5ac302a96ee4aecedbe123ac","namespace":"kuadrant-system","resourceVersion":"144408","uid":"7dc00e62-8ba4-4fc4-8db5-0c7991a84fdc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["72b09fbd9717a531761117e8a137c042ea24289b5ac302a96ee4aecedbe123ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["72b09fbd9717a531761117e8a137c042ea24289b5ac302a96ee4aecedbe123ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"72b09fbd9717a531761117e8a137c042ea24289b5ac302a96ee4aecedbe123ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.602Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:00Z"}],"name":"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d","namespace":"kuadrant-system","resourceVersion":"49651","uid":"6bb1ad68-3111-4f68-be7e-7854cfe4f4a8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.668Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:23:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:25Z"}],"name":"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e","namespace":"kuadrant-system","resourceVersion":"50313","uid":"4ddd51c2-1500-4649-b115-73520a67f547"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-047f21/test-model-047f21-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T01:20:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:05Z"}],"name":"7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630","namespace":"kuadrant-system","resourceVersion":"144328","uid":"345d94fb-8089-410e-951b-5449d9c2dc6d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:20:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.798Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:22:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:00Z"}],"name":"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8","namespace":"kuadrant-system","resourceVersion":"49622","uid":"761f9acf-2d42-4e9f-b5db-ecd2a9c069f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.863Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:00Z"}],"name":"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648","namespace":"kuadrant-system","resourceVersion":"49658","uid":"1ae27f51-df3c-4b45-b2c7-d448e6a6e2dc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.928Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:23:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:01Z"}],"name":"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094","namespace":"kuadrant-system","resourceVersion":"49711","uid":"5f8697f9-b3c2-403f-a69e-a7a6d2eef9f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:35.993Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:12:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:52Z"}],"name":"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571","namespace":"kuadrant-system","resourceVersion":"31719","uid":"53d24a32-72b5-4c7f-b913-332fe2713902"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:36.058Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-w2-58b06e-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:22:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:22:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:22:59Z"}],"name":"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c","namespace":"kuadrant-system","resourceVersion":"49573","uid":"c8c24224-6773-46b8-a6a2-f1ba4b616a34"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:22:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:36.123Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e#rule-1"},"creationTimestamp":"2026-11-04T00:10:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:50Z"}],"name":"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36","namespace":"kuadrant-system","resourceVersion":"31636","uid":"c23add61-5c37-4f60-b48f-14d2e7075f39"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:36.188Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:23:26Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:26Z"}],"name":"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab","namespace":"kuadrant-system","resourceVersion":"50336","uid":"7fa2e4e6-e2b6-4394-93f3-240edd6268f4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:36.253Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/distinct-2-w2-58b06e-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:23:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:23:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:23:26Z"}],"name":"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a","namespace":"kuadrant-system","resourceVersion":"50321","uid":"412e43d5-e10c-4d80-b490-30134a4dbf18"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:23:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:36.318Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-58b06e/premium-w2-58b06e-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:12:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:48Z"}],"name":"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d","namespace":"kuadrant-system","resourceVersion":"31551","uid":"cada594d-00fb-4fbb-87ca-75e64d6ed2fa"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:36.382Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21#rule-5"},"creationTimestamp":"2026-11-04T01:17:47Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:04Z"}],"name":"b32e3e3179c8a47858f894ead7a8edda326b68ece2835880b4e91d10a2e5ef21","namespace":"kuadrant-system","resourceVersion":"144319","uid":"0c16f6db-109a-41fe-9602-3636c673e8ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b32e3e3179c8a47858f894ead7a8edda326b68ece2835880b4e91d10a2e5ef21"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b32e3e3179c8a47858f894ead7a8edda326b68ece2835880b4e91d10a2e5ef21"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b32e3e3179c8a47858f894ead7a8edda326b68ece2835880b4e91d10a2e5ef21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:36.448Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-58b06e#rule-5"},"creationTimestamp":"2026-11-04T00:10:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:48Z"}],"name":"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146","namespace":"kuadrant-system","resourceVersion":"31538","uid":"85559ef1-c3d1-4142-9598-47fa90a4665e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-58b06e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:36.512Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21#rule-4"},"creationTimestamp":"2026-11-04T01:17:47Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T01:22:08Z"}],"name":"ab7f9daf61f4b9a1a0524772716f8d4e8cc444346633083f3bbe60224de5b5da","namespace":"kuadrant-system","resourceVersion":"144454","uid":"db22ad4d-97b9-4de6-a82b-ea9bcf152401"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab7f9daf61f4b9a1a0524772716f8d4e8cc444346633083f3bbe60224de5b5da"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-047f21.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T01:17:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T01:17:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab7f9daf61f4b9a1a0524772716f8d4e8cc444346633083f3bbe60224de5b5da"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab7f9daf61f4b9a1a0524772716f8d4e8cc444346633083f3bbe60224de5b5da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:36.568Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7","error":"authconfigs.authorino.kuadrant.io \"68439942bc9d2e5e55b8a7a764c8b76b5402a1c120ba424d2806b2e9e0f5bdd7\" not found"}
{"level":"error","ts":"2026-11-04T01:24:36.622Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8db0db96646bb38fe64a5ae619c309131dabd03a0d9480bcee7ceb6e63591526","error":"authconfigs.authorino.kuadrant.io \"8db0db96646bb38fe64a5ae619c309131dabd03a0d9480bcee7ceb6e63591526\" not found"}
{"level":"error","ts":"2026-11-04T01:24:36.677Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d3a7e292ed41cccc00138c0668dcf4316413fa3a9288ab3eb15c4acd6c7ebdf0","error":"authconfigs.authorino.kuadrant.io \"d3a7e292ed41cccc00138c0668dcf4316413fa3a9288ab3eb15c4acd6c7ebdf0\" not found"}
{"level":"error","ts":"2026-11-04T01:24:36.731Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/27e710700a9520c20146033207ee7e80e02a212b1fd53006aeb30ee15b136dee","error":"authconfigs.authorino.kuadrant.io \"27e710700a9520c20146033207ee7e80e02a212b1fd53006aeb30ee15b136dee\" not found"}
{"level":"error","ts":"2026-11-04T01:24:36.785Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100","error":"authconfigs.authorino.kuadrant.io \"f7327d733fbe5c6383a720d126126256f14bf08208b8a3fd41568933ba285100\" not found"}
{"level":"error","ts":"2026-11-04T01:24:36.839Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9","error":"authconfigs.authorino.kuadrant.io \"f64c55f22d5224efa4cacf80af5c771971ee9a5c5b463ae64581affccec2f7d9\" not found"}
{"level":"error","ts":"2026-11-04T01:24:36.893Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/495f508b4ebccd223482b69eb03259ed3f378858a1214a16d638acf9d64861c0","error":"authconfigs.authorino.kuadrant.io \"495f508b4ebccd223482b69eb03259ed3f378858a1214a16d638acf9d64861c0\" not found"}
{"level":"error","ts":"2026-11-04T01:24:36.947Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/81d6009326dd8ee3649b6ac7ce6e5056815fb8e71ab61385e3baf97696221392","error":"authconfigs.authorino.kuadrant.io \"81d6009326dd8ee3649b6ac7ce6e5056815fb8e71ab61385e3baf97696221392\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.001Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb","error":"authconfigs.authorino.kuadrant.io \"4f8a8fe725df2e85d61da5cb45fee779f24ed3ad34f82b737c49f4227f77ebbb\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.055Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2e21abec55982c208b5566ee69dfaa4a2240574659d4b4d1679e2305df9ce62a","error":"authconfigs.authorino.kuadrant.io \"2e21abec55982c208b5566ee69dfaa4a2240574659d4b4d1679e2305df9ce62a\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.109Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a","error":"authconfigs.authorino.kuadrant.io \"66200c5106e456c59f392607659d4150c7fab9994f6abd0b1cda5d010552002a\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.163Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/61de55b7272c67cd0d24205d60ef2ef788c198185da35d66bd25bdce26104af1","error":"authconfigs.authorino.kuadrant.io \"61de55b7272c67cd0d24205d60ef2ef788c198185da35d66bd25bdce26104af1\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.217Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10","error":"authconfigs.authorino.kuadrant.io \"51dd5c81b0ae3a8f2ce8869465c17f981769e287e17aef90280405e8894b5a10\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.271Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9","error":"authconfigs.authorino.kuadrant.io \"aa71eb0679f7b573b6907cf2555af7a4fd67bd75ebe00933d000050bc40a08b9\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.326Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/150512874489dd62fd0423b7f033f1a3c304e8050ed2938277c8a94fd4f5ec13","error":"authconfigs.authorino.kuadrant.io \"150512874489dd62fd0423b7f033f1a3c304e8050ed2938277c8a94fd4f5ec13\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.380Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/55e4bc2f59571e614704d8d410615c707576eac1dbb9cefb1ecc61d2096371a3","error":"authconfigs.authorino.kuadrant.io \"55e4bc2f59571e614704d8d410615c707576eac1dbb9cefb1ecc61d2096371a3\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.436Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2","error":"authconfigs.authorino.kuadrant.io \"de405c26397b2ca25a14c498f7ddb78f123fa10e6d351b3d2cbc04b9eac03ed2\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.492Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed","error":"authconfigs.authorino.kuadrant.io \"2d1fb585ff9795d0c4017b3c63f80cba8a31b7b8ea81bfbdc5e127133c5778ed\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.547Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe","error":"authconfigs.authorino.kuadrant.io \"436453c3c24b442da72b21e16c5651e579511876c16080e3c4545411fc6076fe\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.602Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf","error":"authconfigs.authorino.kuadrant.io \"07db8e263b29c31ada55b328406eadb73a451301ae140c72b933f43916fc36bf\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.657Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a","error":"authconfigs.authorino.kuadrant.io \"c3b05eb2f00ddbd080d186a2ab6ea26628a80991ed5abd1eae9d4e44a704483a\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.711Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9f06990fed67aa4e3cdcc906e61d569d1d21161a2dbc6c35f085ca529b3d2251","error":"authconfigs.authorino.kuadrant.io \"9f06990fed67aa4e3cdcc906e61d569d1d21161a2dbc6c35f085ca529b3d2251\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.765Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fee6db2e1fc190126cdda2651161a7d06dc782d57bfa4296d9af134956c60594","error":"authconfigs.authorino.kuadrant.io \"fee6db2e1fc190126cdda2651161a7d06dc782d57bfa4296d9af134956c60594\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.820Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a","error":"authconfigs.authorino.kuadrant.io \"2717abc5d91aae70307b5e2e13686d1aadad90827443644e42fdce482f69fa5a\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.874Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7","error":"authconfigs.authorino.kuadrant.io \"7739e3a0b052bcc93a13c075e06085be4a589dc68bdbf767f80d044b1f5763a7\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.928Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/094be1b8675d0854c7d92783e9a607cb4452c3c8e30ba5a10f2f0c474c46efca","error":"authconfigs.authorino.kuadrant.io \"094be1b8675d0854c7d92783e9a607cb4452c3c8e30ba5a10f2f0c474c46efca\" not found"}
{"level":"error","ts":"2026-11-04T01:24:37.983Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a","error":"authconfigs.authorino.kuadrant.io \"7f7e33298cd44af2b0bac6c87a6f66b9e146072b9a2235a86e08d7f934d0657a\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.037Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/617041f6163f04acf5be2ee3a6a363ac1bc3ddf062941091d28338085032c7e7","error":"authconfigs.authorino.kuadrant.io \"617041f6163f04acf5be2ee3a6a363ac1bc3ddf062941091d28338085032c7e7\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.092Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c","error":"authconfigs.authorino.kuadrant.io \"833914f43c749b0fbf040664409ce40d7564e3e7dbb4981951beeb2376a3e43c\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.148Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f","error":"authconfigs.authorino.kuadrant.io \"ef43bd97ca1f55d9f353914e6ba5e425191d712bc07faa164486a3cd639fa08f\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.203Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980","error":"authconfigs.authorino.kuadrant.io \"a210e044b958f4f4f31edbe2dc94508d757e627db82ee174d51586e7bff2b980\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.257Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942","error":"authconfigs.authorino.kuadrant.io \"1d5a432f96b294984a2ee5d458fe56b691e44f2ae3d51fb04fe21b8f943ac942\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.312Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e","error":"authconfigs.authorino.kuadrant.io \"8d553f580bfb85853435ce251a1ab7eee5fc82840cd45594dbd3cb49d2f9850e\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.367Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/307c361ec926214650cb5c2e4bb9dec1e4e8cebd71b651361277deb7e86e1626","error":"authconfigs.authorino.kuadrant.io \"307c361ec926214650cb5c2e4bb9dec1e4e8cebd71b651361277deb7e86e1626\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.421Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/560c179c7cc53cbe44cdc99d255430893d0c63904384c18fc150123a601f346c","error":"authconfigs.authorino.kuadrant.io \"560c179c7cc53cbe44cdc99d255430893d0c63904384c18fc150123a601f346c\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.475Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387","error":"authconfigs.authorino.kuadrant.io \"aa8f56c8b089a1ce25a58bfab5b771883a20a53b07a35e0d2544f38e4e952387\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.530Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ff8c0672ab4140ed7e3066eb6858ba9dcc1c48e66a82564c44bc66f885b3cdcf","error":"authconfigs.authorino.kuadrant.io \"ff8c0672ab4140ed7e3066eb6858ba9dcc1c48e66a82564c44bc66f885b3cdcf\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.584Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1","error":"authconfigs.authorino.kuadrant.io \"89717bc272b1cf62936f7bdb65b88cec0966c517154768d369cc33751bed82e1\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.638Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43","error":"authconfigs.authorino.kuadrant.io \"4ba017d7df2609ff26d818caf581bd88a9503631108f0e93e0b6ac1547b93e43\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.693Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ca2343d1b5ab18fe82d0c145979b33ecf8598c1d1aac60172c8d284ad3e37de4","error":"authconfigs.authorino.kuadrant.io \"ca2343d1b5ab18fe82d0c145979b33ecf8598c1d1aac60172c8d284ad3e37de4\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.747Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9","error":"authconfigs.authorino.kuadrant.io \"6d08c091339aeaa1cb375f655e5f489c31ee6ad35871f42cfae5a522008730a9\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.802Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c1b2b8e85d76ff0d584379811211b4148b06ec73c74a836375102374954363d5","error":"authconfigs.authorino.kuadrant.io \"c1b2b8e85d76ff0d584379811211b4148b06ec73c74a836375102374954363d5\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.857Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0d1fd44853d54152ef645607885005755fe1dc47104aef14e89790a6f7e8bd8c","error":"authconfigs.authorino.kuadrant.io \"0d1fd44853d54152ef645607885005755fe1dc47104aef14e89790a6f7e8bd8c\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.911Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/aef3cf8d0b74f5d310b7c6d7e37cf57d399f96535f78d0adc708957b4abe8b4a","error":"authconfigs.authorino.kuadrant.io \"aef3cf8d0b74f5d310b7c6d7e37cf57d399f96535f78d0adc708957b4abe8b4a\" not found"}
{"level":"error","ts":"2026-11-04T01:24:38.966Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16","error":"authconfigs.authorino.kuadrant.io \"917421e755440ca68e519d6ef4584068ece33b4f77a649d2e0221fa5f8143f16\" not found"}
{"level":"error","ts":"2026-11-04T01:24:39.020Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/91289812b821ff7cf3d67f16d28e61df5c68d710829fec0f0e316503740bf5a2","error":"authconfigs.authorino.kuadrant.io \"91289812b821ff7cf3d67f16d28e61df5c68d710829fec0f0e316503740bf5a2\" not found"}
{"level":"error","ts":"2026-11-04T01:24:39.077Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e8814ec0bcabc1d155178b62b9f706a82456863dc9d4a57fd217c25b8fbe52df","error":"authconfigs.authorino.kuadrant.io \"e8814ec0bcabc1d155178b62b9f706a82456863dc9d4a57fd217c25b8fbe52df\" not found"}
{"level":"error","ts":"2026-11-04T01:24:39.131Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e0ee5535f920b6aa2431481532fe81c85cc9bb8ae44a576aa54286fa0cbcad44","error":"authconfigs.authorino.kuadrant.io \"e0ee5535f920b6aa2431481532fe81c85cc9bb8ae44a576aa54286fa0cbcad44\" not found"}
{"level":"error","ts":"2026-11-04T01:24:39.199Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-567653-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-567653-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:39.616Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:39.640Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-58b06e-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-worker-w2-58b06e-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:24:39.702Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-ad3cbc-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-w4-ad3cbc-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:24:39.794Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-58b06e","namespace":"e2e-models-e2e-worker-w2-58b06e","uid":"e65cd35d-2169-46f2-83f8-0b72902db02a","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-58b06e\" not found"}
{"level":"error","ts":"2026-11-04T01:24:39.917Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-e89576-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-e89576-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:39.972Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-a4fac5","namespace":"openshift-ingress","uid":"2b4842f0-87cc-411a-9ca3-0e3e3559046b","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-a4fac5\" not found"}
{"level":"error","ts":"2026-11-04T01:24:39.977Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-a4fac5-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-w3-a4fac5-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:24:40.029Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-test-model-047f21","namespace":"ai-tenant-e2e-inf-b-047f21","uid":"3c63f460-1c30-4f9e-9f50-eee4d14ddf81","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-test-model-047f21\" not found"}
{"level":"error","ts":"2026-11-04T01:24:40.127Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-047f21-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-b-047f21-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:40.148Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w2-58b06e","namespace":"openshift-ingress","uid":"2de81cab-b2e6-417a-ad81-6fe26ac95c3e","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w2-58b06e\" not found"}
{"level":"info","ts":"2026-11-04T01:24:40.453Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:40.453Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:24:40.585Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:24:40.783Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w2-58b06e-kserve-route","namespace":"e2e-models-e2e-worker-w2-58b06e","error":"httproutes.gateway.networking.k8s.io \"simulator-w2-58b06e-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T01:24:40.850Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-58b06e","error":"gateways.gateway.networking.k8s.io \"e2e-worker-w2-58b06e\" not found"}
{"level":"error","ts":"2026-11-04T01:24:40.878Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-e89576-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-e89576","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-e89576-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T01:24:41.103Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-a4fac5","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-a4fac5\" not found"}
{"level":"error","ts":"2026-11-04T01:24:41.358Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-ad3cbc","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-ad3cbc\" not found"}
{"level":"info","ts":"2026-11-04T01:24:51.253Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","AuthPolicy","Limitador","Gateway","Kuadrant","ConfigMap","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":74,"update":83}}
{"level":"info","ts":"2026-11-04T01:24:51.498Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:51.518Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-567653","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-567653","reconcileID":"1cb43d3d-71c8-4c74-8c87-669e781bb6b4","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-567653","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:24:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-567653","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:24:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:24:51Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:24:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:24:52Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:24:52Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-567653","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-567653","reconcileID":"1cb43d3d-71c8-4c74-8c87-669e781bb6b4","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-567653","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:24:52Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-567653","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-567653","reconcileID":"6b37f4d7-d4f3-49fd-a871-db3659577ff2","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-567653\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:24:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-567653","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:24:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:24:52Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-567653\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:24:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:24:53.133Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:24:53.231Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:24:53.314Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:24:53.314Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:24:53.827Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:24:55.019Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:24:55.026Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:55.026Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:24:55.028Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:24:55.041Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:24:55.043Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:24:55.151Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:00.571Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-567653-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-a-567653-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:25:01.100Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-567653","namespace":"openshift-ingress","uid":"a2ea4084-c3bb-4bc2-84ad-415ad0bef514","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-567653\" not found"}
{"level":"info","ts":"2026-11-04T01:25:01.573Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:01.573Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:01.629Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-567653","error":"gateways.gateway.networking.k8s.io \"e2e-inf-a-567653\" not found"}
{"level":"error","ts":"2026-11-04T01:25:02.253Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-d48ff4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-d48ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","reconcileID":"ce21e550-b0ac-49f3-bcbf-0240cdd22989","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","reconcileID":"ce21e550-b0ac-49f3-bcbf-0240cdd22989","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-d48ff4","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w4-d48ff4\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:25:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:25:02.717Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-11-04T01:25:05.658Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:25:05.665Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:05.665Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:05.713Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:05.713Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:25:05.718Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:25:05.847Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:25:05.847Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:05.847Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af","error":"authconfigs.authorino.kuadrant.io \"25664c373388b844ec8a4e892bd3fe72db66ffcc17b7ee5b711dbe061a7c87af\" not found"}
{"level":"error","ts":"2026-11-04T01:25:05.913Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117","error":"authconfigs.authorino.kuadrant.io \"ed948471f4d138eb783522126326656b032db0a0db51c46752cc760a547a5117\" not found"}
{"level":"error","ts":"2026-11-04T01:25:05.969Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a","error":"authconfigs.authorino.kuadrant.io \"d5741f1f81f5ae1d58608e46bc3f5e440ccf97dd2663c5a66c7fff42885ddb8a\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.024Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36","error":"authconfigs.authorino.kuadrant.io \"d745342ac866992677f754d7d178778cfe968c467f6749d18e95e6699a2c3d36\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.078Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22","error":"authconfigs.authorino.kuadrant.io \"a2c335997b1dc9c985690b70be14683c75394e27e41ab8d3f5d59582e8884d22\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.132Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644","error":"authconfigs.authorino.kuadrant.io \"64a4c38cf389b0c15d5dfd3bcea2b0c7f1b5715cdea15974e8f8ec414ae15644\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.186Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10","error":"authconfigs.authorino.kuadrant.io \"77c89234f09d97e435d05d0073c6501664ad9a524e3978781bfca1e593503a10\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.240Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908","error":"authconfigs.authorino.kuadrant.io \"dfb06dea7a2b2020e4e293697477284d9897dd1caa8bcd8d231e433306b46908\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.294Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d","error":"authconfigs.authorino.kuadrant.io \"4e00c76b900c7cd9f4f86553d2a7830ec88fe8a7c275936a948034774609d35d\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.342Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-047f21","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:17:48Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"41aa6dc7-fd9c-47f2-93d6-c8025cf52430\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:22:48Z"}],"name":"kuadrant-e2e-inf-b-047f21","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-047f21","uid":"41aa6dc7-fd9c-47f2-93d6-c8025cf52430"}],"resourceVersion":"145386","uid":"107f97d8-2196-4b09-b0d8-db8ccea12843"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0525c4c0827a4fa7a2054dbb397d0948b85f8ca7bacfc94f5663dd80f43acf2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"731736f274954f42070a1a885b62b46aacba13086865b31d54c2f423668b3b53\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5369fb14b4c9747fff329b6d22b318dd96b34aaaf0bd9f2df40bf15e7f913b79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"d163e3528bca5c6ec3b38b1456f4954a1629aa74c70340eabdc3c1032e4870c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b32e3e3179c8a47858f894ead7a8edda326b68ece2835880b4e91d10a2e5ef21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"20bc9de53bbbb54bcc22326d899764888ce871183d0e4f2f7e839ebc2618cdb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"966a3b89b25f42fa12afb1fa01a22d057abc3a21a8ec51e3d0f3c83c63e49d9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"0f49ffe44f2a7ea94716bbd9f932ea3b75cefc633dc7edf36b92fb54d485d2f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab7f9daf61f4b9a1a0524772716f8d4e8cc444346633083f3bbe60224de5b5da\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"15e495cb76331be1871831d6cd7a3bfd2763cdbd85b016277d6e3c0e91bc15c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72b09fbd9717a531761117e8a137c042ea24289b5ac302a96ee4aecedbe123ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-047f21-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0d1fae18\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-047f21\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-047f21\"]}],\"name\":\"0b53a0a51f013fe565ccba1c8c082dc2ab58cbfc6228672d4295281ea5323df3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-047f21"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-047f21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:06.349Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c","error":"authconfigs.authorino.kuadrant.io \"86c6122c62dba7fa45617de25d9946309e9de9b3ac8c2dfdc7cccacb13fd1a0c\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.404Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7","error":"authconfigs.authorino.kuadrant.io \"4dd04c26d5821ca296ec540a504cd9afacaf48429bb81770275d33c77d28eec7\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.458Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8","error":"authconfigs.authorino.kuadrant.io \"652a25c4864c74a26ccda75e501c9ac20ef3b9b6aee3121add4b9370e85252a8\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.512Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1","error":"authconfigs.authorino.kuadrant.io \"13ebfd0c0d84950cd924dca9496f6e3fc185895a31984b2eb16ba3b6137881d1\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.540Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-567653","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T01:14:46Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:24:13Z"}],"name":"kuadrant-e2e-inf-a-567653","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-567653","uid":"7627c4a3-bc43-4739-9dc8-43c1b3fa2fd4"}],"resourceVersion":"147533","uid":"88d15361-4538-4067-a295-10eac23868b7"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"0b1a56521a0c26caf235871aedb602b5e8ec34d357cfb5bb798739db3047de74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"5eced2745940640ce546e289f8794270a15642dd276b93577c3de730b4c6382f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"aaef5613c6cb1087de33139be37421ba4d698b456be39014dd402b24437f09a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"64bd01c13d26bc3e567f123ecf2f8183f58e588bb3c05cbf5bc07047e08343e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"6d4943470a0993df71ccd3c155e0dc41fccb2eb62830f9abeb2b635e3f12329f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-567653-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ead37d0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-567653\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-567653\"]}],\"name\":\"89b769ee6e98227227bd288da26910ca294c4e62a32888de7fe4577fb38a24b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-567653"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-567653\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.570Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8","error":"authconfigs.authorino.kuadrant.io \"6e7fea92c86b342e221a7b53d4eeb01ed4072318713221d08cf3acd784af76f8\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.624Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1","error":"authconfigs.authorino.kuadrant.io \"eefa141397662815c0d375b9a61e1a4ec7c6388fbc6e413085bf63dbcb5f9be1\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.678Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2","error":"authconfigs.authorino.kuadrant.io \"eaeadb9708d91d6efeca5220973d521432fa70ed514b47adac9c92cfcb3d25a2\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.711Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-d48ff4","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:44:24Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4822deea-cfc7-4012-8bab-7aa664065e4f\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:24:14Z"}],"name":"kuadrant-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-d48ff4","uid":"4822deea-cfc7-4012-8bab-7aa664065e4f"}],"resourceVersion":"147551","uid":"2cb81ab4-d10b-47fd-8ee0-a5914960e25e"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"a8145813a9b56dc34ed50dd81fc379ed19f75a26ecc67269c54fb433b09cd1a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"dbd867a3282f4d3f0b2224e9a0a717b6688c4853b976493add937469edc9dfb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"79016ee4b4f966cf6c441f34579ea049f63637553b8193324bae0aa836b2db7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"df2665493c1179abe9d1eb2a996b4ad965011d3b3e7e7451c8f64999ea7e5e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"c8cc7f1ee42f8704cc0aa6fe662e93eb76b065868d0b1ca19a262a9434302ebe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-d48ff4-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a525f354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-d48ff4\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-d48ff4\"]}],\"name\":\"37694e0fe4a8a4daee6cd09ea67587f3f90a67fba636fb5f0a92fd82ec0cf000\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-d48ff4"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-d48ff4\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d","error":"authconfigs.authorino.kuadrant.io \"ea7400025973553fe7325b4a0026653fa1d1ae44d49874f370ef088e23f2c97d\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.787Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82","error":"authconfigs.authorino.kuadrant.io \"6d77b893d7ba3395b866e39c533b3bd06c30c6bf4293329793c6c02ea4702b82\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.841Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac","error":"authconfigs.authorino.kuadrant.io \"7f445b8a913661060594bafec5480568a8887be6aea80a22e6b2a03f34e714ac\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.895Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826","error":"authconfigs.authorino.kuadrant.io \"57c8abdbe32069e796aea04047913f9ef57fa21b27eb45ba681e0abc0133d826\" not found"}
{"level":"error","ts":"2026-11-04T01:25:06.942Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-e89576","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:43:52Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"921550b9-e248-45c0-b3dd-b3c75826bf69\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:24:13Z"}],"name":"kuadrant-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-e89576","uid":"921550b9-e248-45c0-b3dd-b3c75826bf69"}],"resourceVersion":"147525","uid":"d0208b1f-740f-4ca5-984a-09841be9a98b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"3ea848ea7a28ccec66fa770b3af2452b6b0b907146017230150b4eb245cdf478\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cbb2bfaa3f7807da810e5291128dafdf0ad6a95e35e1e8579ba5c146fe1b92b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"755a0cc7a588e772af9132fcda445bc892a59b574f2f7284b043f1d478444943\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"cfbf9c267cd9cb7b63a74fd1748936a93876c7424601b821496ba7463c22e3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"5b4bf640448cf71b6adb08f5416cb2f93badffbd5e65a485b88a5db0cb08b40c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-e89576-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__af83754f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-e89576\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-e89576\"]}],\"name\":\"493cb8642d7cbb23499392f14e4d28be76ed3e633c56318221b47ff22efa9714\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-e89576"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:06.950Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec","error":"authconfigs.authorino.kuadrant.io \"eee17a8350f5f8a613bc7f747011fa34b20298e0aa2f30c8ff80e8bd9f4c8bec\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.005Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab","error":"authconfigs.authorino.kuadrant.io \"557281608758c88045093078b3a59f49b9383579fe7d4370f12c8dc34c530aab\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.059Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea","error":"authconfigs.authorino.kuadrant.io \"4f43446126bd826eb2d5fa585dfdcec88811b6f8e85d695d00ecda65ba75ddea\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.114Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c","error":"authconfigs.authorino.kuadrant.io \"abb0eb03fa34a921700ea1e0fa911be9d2ef04979ddba4e0c34382309d1d486c\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.168Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026","error":"authconfigs.authorino.kuadrant.io \"ce064cca95e5b7e429252cd802e2e40cf551e1787df5b9db06878dc10913b026\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.223Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec","error":"authconfigs.authorino.kuadrant.io \"f52b1ce9bc4a9808ea35e908113743376d71b7275d2d97b76a9155f4dd48ddec\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1","error":"authconfigs.authorino.kuadrant.io \"b000d9398c095b407e4f0197b8f7085aaad43573fd20e4251c6b9ec089b0bee1\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.334Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0","error":"authconfigs.authorino.kuadrant.io \"55bd1d55fc43505cd82cb8a9c6303524ed2d63f8d5954436e569bba0e03ed9a0\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.389Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350","error":"authconfigs.authorino.kuadrant.io \"1a76c67a37511d2d625b3e56f13482af24f6eab63faed13d064b13d257d2a350\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.443Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701","error":"authconfigs.authorino.kuadrant.io \"87dcb00a00e564e3011f3be4392ec213476a5c3b4ee21ef03849ef44eb158701\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.497Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630","error":"authconfigs.authorino.kuadrant.io \"7c8fc40297068295be44ca9879cb17f1b1091d61ee0f6f03cb7e44e644012630\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.552Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb","error":"authconfigs.authorino.kuadrant.io \"8b14ef9ef9dcb4ac2050ffd087cfb8b21bc978c4f42b09b8a853930cfe27bccb\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.606Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094","error":"authconfigs.authorino.kuadrant.io \"9179529c843f600958ee9fc3678bcb78fca2b1706947d3f94a05d96e5a4ae094\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.661Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571","error":"authconfigs.authorino.kuadrant.io \"7ebe9ae1f85316375658eac27dd2d5b79aa16637a711985c3b061c649c223571\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.716Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329","error":"authconfigs.authorino.kuadrant.io \"5c99b86da5251d01829a37eb2accaef94e077356ff06532477aa934d130c2329\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.770Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975","error":"authconfigs.authorino.kuadrant.io \"4b7daa0d8de4bd2706852af1739df9c6027771eb0587bcaadc0215d6c256c975\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.824Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146","error":"authconfigs.authorino.kuadrant.io \"e460278e89a891ae216f8b1709f7e0873f49a196c89ddc6cbc72728644e32146\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.879Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8","error":"authconfigs.authorino.kuadrant.io \"cce7ca228eb4598c8b201710cc9c0b7f4f278a0e46950393654c58e8d443f1c8\" not found"}
{"level":"error","ts":"2026-11-04T01:25:07.933Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9","error":"authconfigs.authorino.kuadrant.io \"68895b3facec83a3825b8d19f9a2bc5a13484ad26e87f25134c742cfb957e2b9\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.073Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5","error":"authconfigs.authorino.kuadrant.io \"5a613fd5e8a7a2c75a1e50d174098615c629a8b55be41acfbb4993d3d0175dc5\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.128Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2","error":"authconfigs.authorino.kuadrant.io \"29ce4934384d0a8583a2116512fb1c3f2a50fab66d23ab90fcf2b29bfcc72de2\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.183Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a","error":"authconfigs.authorino.kuadrant.io \"99edf9880159d491e91e0c0956b6f62ef92565750f057ace3fcec1752a48925a\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.237Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a","error":"authconfigs.authorino.kuadrant.io \"d0152c87dba485db2c7442194169edac660b10389054943b5033c951a470118a\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.292Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1","error":"authconfigs.authorino.kuadrant.io \"0b878924d2f914ffa70439f67f2f090e005d655d82758982348b339374a247e1\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.347Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11","error":"authconfigs.authorino.kuadrant.io \"f26b7e72c39f3b234c95ce9131349f59e3aaf0199bd018c4e18d8a73f4bfef11\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.403Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016","error":"authconfigs.authorino.kuadrant.io \"16f8d5bbcaf7d2d2df00d244c160a63cc5dfbaaf2392dbe92b1d56493929f016\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.459Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2","error":"authconfigs.authorino.kuadrant.io \"e932b8ab8ed430d70c19241ea903aca5108d00139ed13a565b321023a8f324a2\" not found"}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","reconcileID":"d4ff8d97-75dd-4431-8ae1-543efe11841b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:25:08.513Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694","error":"authconfigs.authorino.kuadrant.io \"19f737a6c5d8d894dbcad0b34a1afdf569929be8911bdb3fe55854b30b17c694\" not found"}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T01:25:08.567Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be","error":"authconfigs.authorino.kuadrant.io \"3ab73ec034a60498921214af6216b177863c4f37b936bd3ee13e761d0882f0be\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.622Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11","error":"authconfigs.authorino.kuadrant.io \"45ac990671a608f5079d97eae6b4bda5b965917bdeebd17ec56172a68f98ed11\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.676Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8","error":"authconfigs.authorino.kuadrant.io \"e1454b52bf5d147f86bce9992ba56d466317eb2f1d05683603149c5372bafba8\" not found"}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","reconcileID":"d4ff8d97-75dd-4431-8ae1-543efe11841b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w3-e89576","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:25:08.731Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6","error":"authconfigs.authorino.kuadrant.io \"63284f7dad292030d775ddf70a0e11ebed6e7ae5c71380da33e13fd9ea90ada6\" not found"}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-e89576","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w3-e89576\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:25:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-04T01:25:08.785Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297","error":"authconfigs.authorino.kuadrant.io \"5903a18ffc8dc55cbcefb32e4db1fa24963c63b17d593a66532619c86cdbd297\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.840Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648","error":"authconfigs.authorino.kuadrant.io \"829362027a511bd5611e4fbaa4aa64475a904e891907fa65ab6c8d9134eb5648\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.895Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6","error":"authconfigs.authorino.kuadrant.io \"3a60453712c501b66acc1b75e830fc2165dc9de5717fe0d17cbb88a5d25a39b6\" not found"}
{"level":"error","ts":"2026-11-04T01:25:08.949Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654","error":"authconfigs.authorino.kuadrant.io \"01c1d6e19f4fdbf00c9371ee5e936e2256aa3f06ba5058ff11e9d98967f6e654\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.004Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346","error":"authconfigs.authorino.kuadrant.io \"0199f47965ed9adcc6ee51d32c1811e9097d485514fc3fae1c64cfd6cd084346\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.058Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c","error":"authconfigs.authorino.kuadrant.io \"321b33bcadb2e425f5e2e96872e3915d47b7449d92d1dfc1de2527ae0e11614c\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.113Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e","error":"authconfigs.authorino.kuadrant.io \"f02170f3749231a910d2dd126048a5450deef68d245785931dace89b9ea3a72e\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.168Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b","error":"authconfigs.authorino.kuadrant.io \"8d5a3e947e1ef72e536df8273cc980512b6dabe5c25e82234e3bad1f8c4fab6b\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.223Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf","error":"authconfigs.authorino.kuadrant.io \"819b815aa80ef3e08e8bc4cc6fa1d31829ebcc42cfd18fd5c23d90fe2b6f3eaf\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776","error":"authconfigs.authorino.kuadrant.io \"c1a7fecdf21f57bf392281b3b268b18452632bef5b01fe488d26c40ad4d72776\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.332Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8","error":"authconfigs.authorino.kuadrant.io \"fc1a3f46e52f65465f387909a1fe826ed0bebaede18615b6d03c232d813259c8\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.386Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d","error":"authconfigs.authorino.kuadrant.io \"194b06bcb3e268244cd8d0c5ed30607896cf8b286bc4231d56b7a7aa63a1d78d\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.441Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc","error":"authconfigs.authorino.kuadrant.io \"9eeedab9c11120b94fec4baf8a812e0f17f2cf4d17508886f97cb87d3cc619fc\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.496Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e","error":"authconfigs.authorino.kuadrant.io \"d5715a5a9320997f1fee63385615eda26395533c2612ad363b7f15480480bf4e\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.550Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929","error":"authconfigs.authorino.kuadrant.io \"dc404eba5935dba05706aeaa7bc647f4265f9377386e48eb6828047ee8526929\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.605Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca","error":"authconfigs.authorino.kuadrant.io \"4f839800888b48fbf75d26125a256a7a60898bc10b0a4e10fb67fda0053f2fca\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.661Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0","error":"authconfigs.authorino.kuadrant.io \"e6ed06a27790066bdea671967a5ec7bca72376e619c459640b69f1b0b6a543d0\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.715Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450","error":"authconfigs.authorino.kuadrant.io \"141f8cc70bcc19712e65ab2e22281f1a96dc5dbac3385667b53542aee62a7450\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.772Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f","error":"authconfigs.authorino.kuadrant.io \"01298cc5b011138ed0598ab7c4e2786419b7f11668388aec07e01596720a459f\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.826Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d","error":"authconfigs.authorino.kuadrant.io \"dd8a575ab3b3dfb97bd5f7c8648deaab508d59bf93643395327318f92c30a54d\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.881Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85","error":"authconfigs.authorino.kuadrant.io \"f6fd3c9795d9e5a3f50c5182e1722016d4a5f00e820d8f11774842583f704b85\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.936Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87","error":"authconfigs.authorino.kuadrant.io \"29a8050b5c96ac6fa2590c724e07ead2cc563746a9c42909438b8b588231da87\" not found"}
{"level":"error","ts":"2026-11-04T01:25:09.990Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8","error":"authconfigs.authorino.kuadrant.io \"b5f88b451dcf801e879d708b59102e1b0608094d5a6d630a43cdb72e7becb5a8\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.044Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a","error":"authconfigs.authorino.kuadrant.io \"f722b7fb0963c31d8b37afd32565380ffd90918883674d00e1231eee74d8cd7a\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.099Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f","error":"authconfigs.authorino.kuadrant.io \"4c71f0475d2e111898723ef0948c31147b28a11027c0394e1a83bcd43616c19f\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.153Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67","error":"authconfigs.authorino.kuadrant.io \"ac32d287bd66978602128e1f4cdb6cdcebcb5a516179aa38d6d19fca0d7f9f67\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.210Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a","error":"authconfigs.authorino.kuadrant.io \"082744be79b841fa6621189ffa93c5862dc05fb8ad6cc14778185404de2eb80a\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.265Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9","error":"authconfigs.authorino.kuadrant.io \"d84469ebb9f3f8d154873b8ecf20267b9cd21e9e09dd871d599b9c1453bb23d9\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.319Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5","error":"authconfigs.authorino.kuadrant.io \"38e251dc09fbe735ed2311685575cac7d7f6e3dd9af13d8e1aa257ad32cc34a5\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.373Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf","error":"authconfigs.authorino.kuadrant.io \"54075e7d70b7e7de9d2673efd151d107f78519b65f4f71abd6fa5c06bf59afaf\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.428Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0","error":"authconfigs.authorino.kuadrant.io \"74fcf6e14199b883ca416b277c682c026c800844ea2dd8dc3d98930f2c4e9ce0\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.482Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451","error":"authconfigs.authorino.kuadrant.io \"85170c61de0c2bf48cfb33b7634228016d88b0e4905e99bb846b4a5b5ff52451\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.623Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-047f21-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-b-047f21-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:10.786Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-d48ff4","namespace":"openshift-ingress","uid":"2611a16c-9f22-45f1-b70f-9d5c2aafa689","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-d48ff4\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.842Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-e89576","namespace":"openshift-ingress","uid":"bf4049ef-8da6-4d54-b848-f1e7368189d0","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-e89576\" not found"}
{"level":"error","ts":"2026-11-04T01:25:10.856Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-567653-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-a-567653-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:25:11.071Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-d48ff4-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-b-w4-d48ff4-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:25:11.324Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-567653","namespace":"openshift-ingress","uid":"a2ea4084-c3bb-4bc2-84ad-415ad0bef514","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-567653\" not found"}
{"level":"error","ts":"2026-11-04T01:25:11.442Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-047f21","namespace":"openshift-ingress","uid":"f9dbbb21-f787-46f5-b60e-33b6a5255123","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-047f21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:25:11.564Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:11.564Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:11.689Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w3-e89576","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w3-e89576\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:12.138Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-567653","error":"gateways.gateway.networking.k8s.io \"e2e-inf-a-567653\" not found"}
{"level":"error","ts":"2026-11-04T01:25:12.259Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-d48ff4","error":"gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-d48ff4\" not found"}
{"level":"info","ts":"2026-11-04T01:25:20.914Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Kuadrant","Limitador","ConfigMap","AuthPolicy","TokenRateLimitPolicy","Gateway","AuthConfig","HTTPRoute"],"eventTypes":{"delete":100,"update":8}}
{"level":"info","ts":"2026-11-04T01:25:21.135Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:21.145Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:22.527Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:22.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:25:22.746Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:25:22.746Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:22.817Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:25:24.049Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:25:24.049Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:24.056Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:25:24.066Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:24.066Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:24.114Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:25:24.141Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:25:24.141Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:25.738Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\" not found"}
{"level":"error","ts":"2026-11-04T01:25:26.043Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-de0ea2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-de0ea2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:25:26.230Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:26.236Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:27.013Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Gateway","AuthPolicy"],"eventTypes":{"delete":7}}
{"level":"info","ts":"2026-11-04T01:25:29.262Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:25:29.263Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:29.272Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:25:29.339Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:29.339Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:29.358Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:25:29.358Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:29.358Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:25:29.473Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b","error":"authconfigs.authorino.kuadrant.io \"c7f4cfe44c43cf39ff36807e5e6060e7e5d42bb956047454ed107e958a4a878b\" not found"}
{"level":"error","ts":"2026-11-04T01:25:29.542Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e","error":"authconfigs.authorino.kuadrant.io \"b077456c4698f46395bf72c49bb0d84291d17bd96588ad12f17a08eb83f40b9e\" not found"}
{"level":"error","ts":"2026-11-04T01:25:29.599Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464","error":"authconfigs.authorino.kuadrant.io \"f37159d6213e8c377b41168166b3ae4064ccdd816e24f2c6eb3d5a78b759f464\" not found"}
{"level":"error","ts":"2026-11-04T01:25:29.657Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269","error":"authconfigs.authorino.kuadrant.io \"3bbee88b55d7610a67fa0226a6b4582e4a516c790a4aff1771283b0d6b186269\" not found"}
{"level":"error","ts":"2026-11-04T01:25:29.711Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299","error":"authconfigs.authorino.kuadrant.io \"795ab8ecb9d14b4c2f5be35e13fcc1b01a7e1ead9353f272c09c483bdc7c0299\" not found"}
{"level":"error","ts":"2026-11-04T01:25:29.765Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba","error":"authconfigs.authorino.kuadrant.io \"a590ab30e519c842da0d75557b50a68eaa8bef675d020e6ddaf8234d250486ba\" not found"}
{"level":"error","ts":"2026-11-04T01:25:29.820Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334","error":"authconfigs.authorino.kuadrant.io \"5b0d4885fd0ce1fa93784af234fba455b0f387f00f509a3ac8f93e3dfaefd334\" not found"}
{"level":"error","ts":"2026-11-04T01:25:29.977Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2","error":"authconfigs.authorino.kuadrant.io \"3dedf2bea64f8c3fca3f055e2dec25bd19812915de27831c0b4a0672324f70d2\" not found"}
{"level":"error","ts":"2026-11-04T01:25:29.996Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-11ea30","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:27Z","generation":20,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5f9d701c-f599-44d0-846f-c2a7e5638d99\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:03Z"}],"name":"kuadrant-e2e-worker-w3-11ea30","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-11ea30","uid":"5f9d701c-f599-44d0-846f-c2a7e5638d99"}],"resourceVersion":"82163","uid":"d38a62c0-eb55-4f83-8e14-0f0bf8683fef"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"7e501414e2d808948b5eddaa7f3eb13b4877ce82957d2adebaf34a836c5ce444\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"fa4d09e98a2556f31180e48c4d9d80995168b68c25255a6617ff5fcec5af76d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0e265f41f92f25d7807dc08172a944eaac20288601372a86e930f1345946c867\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"8ac3a676eccce06c93a581175c31eefc5da410e70579309c902ab32597ac5f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"099db7f703bc18e91019eee55e14ea78311b9e8c006a6d80178b4427969bbe2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"d167486b3a286179f2a574734132194356fcf46fe317fbc094da630cd968b226\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"59ce02df7fa04b0cc60f0ea6f22aa086b0f51340de5d6c38e7697282ade95583\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"4bd8db4d8fde3b6527fddb55cfec241fb481828efbf9384f3e0afc5cf1134067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"290bb37a29b764a67d6d28298d3b239bc4fa201a3722b25741fd74ee359cbca8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9be45ffa797958c72a1a39203c0b588ed452ee5d9d252c5df9004f63ed498d07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ec7eda29a80355e79ad584ae112314a634ff966c3845c322adb4c7e30a115927\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"c946d75bac431574ecf87a5ba47e15caa560da872a09174b5036bf9f90c0ebd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"f7e700fd716c6572c297a61d035137c0a615240ceb902a6f605517e43cb3b51b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"024c8305fe118d0adf871619e5660208bb3382c0be529a41df5bf4c8b81e1a41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"02e591b14d1d911b248f6a57615920c164dc27ece5d75dc59e40f7c966017a86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"d6c7400827550730c2698f1fda6eab32d7ec1af6b7a019c1baa88a91919eae34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"48797135d73f587e843f75f61ae594882c62d94de2fad142f884d56b879787bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"02778cc72718db248e0a19e01423d397465a06d51f9ccb69e6ebbfd24851cbf3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"5a8ec189257589d6eb2f8119a6e11a4ef922aa17b4e7f72784d8a4295931987b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"052c0658d6bef841b2dee7dfa4a1ac26c6104cb5e1b1b5ff1aa72d06ba0068aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"5f33cfc21b53390e53f539550daf92821f9f9966396b0c1b8dffc81c79834ef3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"458fc67391ba189a51424b60a1833c6b3aac1b0d9a80b66bedc8a4bc0720cad4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e1263ac989787c1334fae799fad37ba5523a9c7fea8a3ced963e53e133ad05cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6634be4e1e349e075fa306fec4cc8d490cf8e09f34d63f6366662a1e5da80f59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"567cb1329c5ce873181f63aa9585b36cbdd31728ac0ff948e77b0038d7b0d639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0cc742b9a303446dd9839593bb0c73439ebe804c6983e77f44562d58f11d5bf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"a1b7750bd5e7b7007476ebb57ac4209b2603ef7fba2a1dfc6830a5e86f72b5ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"533f5e66529af854e63da092f4998096cda919d44d8f250f0bee8346a83b561c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"60dc4f43d30a83a433e7a7c8ec26760512fe3b6834045fed257f83519e1010b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"397ec11215416691c2d8065d6f12e30fb013ec47cb386ea293533603ce3c74d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ef2202f78c37e4bafa6be5121685839a838127cf98c583957df554688be0c13a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"61b462ba56beb0dd5c7a00db5ec898e65270993d6a30a37aa3f95c03740e42cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"6c33dffb6bfe6129da2f607bcaf300235c0c955b262eacfa84e45b66cbc52926\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"2831ae6371f9fcc08ab710fa949e52c2b1060e6692e034c9ac5336473e5e77c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"c4e20feaa61d40b392e7c478b4878f1e369578fbfb2cdcbb2efa85fd0f42cb97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"7d11de4de428673bfe2ea958eeedb0f76eeeb719dbc4f94205024d3eb2d7a40d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"e9bb7245f77cc45af3616db7e75d0905c9415f2cd7e6afb8e52b0903c5026fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"13f864bc48d9cb4c17311cc93c47e92f9e68f847b23fd1d989c1777bf12ecaf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ca4e394888dcdbbedd3071a78dacf7f7734b1637ce0022dd06d6c8d5db89a9d7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3889c79f942fd5cd87050886fa73bf885ce15f36f46450a0b06680e03f0945e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b51976e87d63318dca70c311ac6aa5346c87110ea930c83c8a7e6be98276cb68\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"c042198a65c10a236d44152eb94d1c9ce282012744b5881818ac1c789776cc86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"064cd97002a8adf3f73a1c219c01ede3a466154324bf9c2d38ed802996fa1c93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"24055b76dd1b2b1074b2af17164520546ebf3584547ebb08222e57176c469cec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0814649228590707265c0c5f4c05481a24e467825eb04f2cfe9b050cec451475\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"101523cf77328d6cc8d89b725b6358b5399ccbf12d0f5579fea9b252c21ed884\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6d1abdeb903d5c7409da81b9494cfb02588fce8bc268ce067c72281f3d2a3423\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bd98fc62222edd4f185fb418cc21b343cd8fb7dadb018d20322923343b635a23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23582f77e306c43fbb9c186dd67dce35dbac27b48c88e55ce95f824242e5c070\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"4653b49e1df2d1ad70ac0cb086bd25a161a083daa5623830bf9c23a4d32d81d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"d273924852db8aadf7dd4228e0f5a246820a4ddd31c0a3f987b9bee859fcb85f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"0f5c60927f2e0fa483306b2cb5bf209e25b290919908f47c32ecfb3f2d4ea741\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b9f85a204cf99a8911948f83837caa2637e403dd000a62a8fc8effcaed065b7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"5d80974a71752b455cbe1cf7f6745663ec15276dc551e435604c507fc7e1f824\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"8ad362d32578f96da0402397f19717a43bb6b422cc88ff4f9f1fcd9f9f051ded\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"996699b8fde3fe7b82d7fee633be4828868331af28fd31564d51eafe4050a887\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"b6cd3cb3d8fe6c97811a84bcefeb660f7df86ee280fdb597ead5f618d1f1ff9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"50366813a245c7608d0499fe96aa6bcb2aa44c936eaff981254612745a5997bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3287a60b3c10d53d6c1dc921ce50cc0e03b5652bb4969c0f98a7844bcd398280\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"a94425a593076417c83b2a40f12a8ae3c5c6b662ea65b8547feb3da20c01a7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"33b8c81c912fc47e6e2de04cb9f5de615ad2f5719d8c77a44640d718076dd61b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"5cb8b3de52308e835c6dba6ef21bbbd5cdcc08e3a265f908db28054feb938acd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"9ba49527c258b531f2ee72b000f546a9ebfd260a661984e53298846f5ebcce92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"ab28c9d732dd6eb9a5c664acc03cf1b527de0c2428670674b22dbf4902b0d28e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"797ae6033407ba51a6da601a47eb6f0aee25cffacff63d84822e2ead6e27cc17\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e20a7320c56120af7dde4839033f5c4891aa05d7c9eac837d45775e251dd40bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"1cf89413c4e9b557bee9f2d1b259d19dd3bdd194fa97af466a817747d338f22c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"bceae3e6581f689850ae06da68761e7a9701cc2befc42b5db23b5de587eaa948\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"6820726e004d8eb5c0fdc5bf7ceb2e9f78a4c533b6cd4ca0e024f6f2969a5489\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"3740f1f42e103769f8eb7f75f85c2046536e7cd0ead852ec9eaacc5bb6b1828c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"92a48cb8cba483dd253a3593c7e275206a0068f8bf2edbe9cc778c48036b80eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"dba8d67f8dc748e736bddfde9787dcd9f2abc4734b33904c161dad62fd54eb51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"23e5d03604f396cf0f7722326bd1ab80ece27d6aa17559855854e8ee3826a9df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"f69075aec72ac5316b8ba068397d9bdf8b100ff775c12f10dc7c4a33141e4e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"39dd8dd5a8484f7acdaf3dc3a0c56c3398c524eb4109939c214eb63699129f86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"28bcc6325fdd4b99a4f30057dc26255507ed669f632fedbfe422e47bc4af05f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"816c0d35beb47f6d90c29c30bffa876aa137bb36f61871cfa8a2aec40877b53e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"b5cc0bb9c7d9964759f7998f9585e1e621c82d9037273b378114680ff9987fd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"d6fc562ce8225bbeaea0c1a8d900c397a0f6ffdd32d289781d766cd6717275e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/simulator-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__0321c1db\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3547540116d20565\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-11ea30/maas-trlp-premium-w3-11ea30\"]}],\"name\":\"222e4bc4c432b58101d67be0f5d1761ac686be63bd1cd2368af1e6ccd4ab2af1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/premium-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"e76915430709bf5feb36050c9e422151d907c366bbb29f3971af1c955b350a6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-w3-11ea30')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-11ea30-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__86e0b533\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-11ea30\"]}],\"name\":\"fa6dfe6a45bf0083d1bbba31cc4b6ae0995579a3592c3a4aee778ecd3ef10c7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-11ea30/models/e2e/distinct-2-w3-11ea30')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-11ea30"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-11ea30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:30.032Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea","error":"authconfigs.authorino.kuadrant.io \"68a784a06b149e297cce2077e19461e99a615213d205d387e03cbfcf0732cbea\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.086Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995","error":"authconfigs.authorino.kuadrant.io \"209eb4ae5c679973f4ef7974d2ff5e78af34b56ddbea9f0a53c79eaddf253995\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.141Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725","error":"authconfigs.authorino.kuadrant.io \"ab68408a8ce8b7ff28d838923db81bf47305b710c8d7a4930904a8148fdcf725\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.195Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3","error":"authconfigs.authorino.kuadrant.io \"296020387ad2e33186191e2aa687663d48f4d8befd2102eddc51622e9204e8f3\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.250Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031","error":"authconfigs.authorino.kuadrant.io \"d884a6b6f0f4f65433eaa56cd7cf08cf06f7b91f7bda4712c346e61bdf22d031\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.304Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1","error":"authconfigs.authorino.kuadrant.io \"c3b21e11cafb31e0dee5ad8cefee21ddbdbb5eb8cf9fb9a2f3ad095a9291c8b1\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.359Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da","error":"authconfigs.authorino.kuadrant.io \"706e6a1ae0f69c79a8c07253b86cde14b67344132d12990fbe4dc52896ed97da\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.379Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-de0ea2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":10,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"6e7eb8f6-4c81-49df-885a-1cfd92034b41\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:41:32Z"}],"name":"kuadrant-e2e-worker-w4-de0ea2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-de0ea2","uid":"6e7eb8f6-4c81-49df-885a-1cfd92034b41"}],"resourceVersion":"83291","uid":"ad417c34-a43f-49c3-8386-dfcd19d97287"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"8f41f5d27f92196508ddee2fc47e51daf5af5c4825a7e8591ede0800be949fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7a4e12ba594de064264e5a79bafadfb910f6fe0c5c088cc1d86aa478feff909\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"545e35b30c59a1aa62ea994b7a5be31f8d3760ca10aeb1ba456d4eea87cf7a6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"a4133ad72b872fc03206a842894304ad17b775369b97a617c5b595bdc943e826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"771078d889ef85b81946eff0b2ff32fbabcda38cbb208fa37bb96509f7d979a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"bba5991046822f1b6e0758327a2491b9658a798d2b607b2a7144f024f0067676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6d451581ca6171a655cb504496641e173bb76b72741c6c02eaed94083a536735\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"46cfece21c467f625b03ba5a104af0b1e8d4a213c5695ef30a112544f1c16cbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9d157bb2d1741f38e7e5854412ecaf7c47f4b489927c97cca666d33d1bb4d834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"a6089be44340b73e309196db9a8c89f042bf2d2570f1e88b8378d364827acdbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d186d8e5e42a867e2a08face337b9772aeae6ba493c896ca867692f02c4456e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"8d1e7b487515ecba92117549552071598f9233e149b32fc4eb13567225116a07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"68a9c4eb18e71677a594352b1b7ad0325a4c685212ace060db3b90da668c6f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"5cd2749f5fa499321c3a48c9e432951a046807348668fc35fed27b72ac6db3cf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9d55be3daa24118dde3ad2d28e0c6b48c00dd4df682a4745fb2c1e69a0bb735c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d5d96025b93f14012073fc9c61dbf91db95fa9ca2b726ddb91f601e538620862\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"06e46d8eb2da8005de0d157a8845a587567d7612ef6f79fc810ddaf2f78d6bb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"66272d32af643987684100422c0268e207c651a098012b0f2f6c77f68bc6d25f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"84d595c1af2ff8ed9ca0194212a4eeb97f3de15fbf7e225e4c6eb56d5a39f8e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"c13145cd6f1056971233d0e758c11ce8cee133a64eb3cf6a02b122d5a29a71a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"31e47065c52fb96c2470ed21a3d45c533ef5c080afe214081ff5637fa2b0d420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1b9a9d0030ed877e95dea36c3d55d7589cb8b6b826be9455de9bcdccb31c4a39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"f7db200bfe44cc9433850257d064b4edb5240dd6951e2251e271d79ce2599c45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"042db8e6145979020b4aa2ccc468918dcb1f32d03a1880a86a855cf8560eb16f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"5c91323526e4e1197474b1874d1ec0a636c457a84e2013e3688214b3c9f40292\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"56ff390a2f15a60052acfb6c577c0d99916ec6f8ec0c500a95983e8cd3ea840a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"26bea37b48ab2ee00f259c3b8c9bc4c47b26a86a798c02dc31f2843e47829ca7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"19013eb61834602135d4d3c8ffee368d3060b9b63fc5f9bf0951d431b8c38fdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3b814cb972103fb740b36a5d13d0e90ab61a2243933f933f775c42677c1a5d85\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e7c8f0c364705957418c58fc49a204d16bc88650633ba572edfd632ab77f5666\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"91cab405f0636396c7771c6dc75f806c2ca022fb0848ae3c2fcbb33e22a339ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"67532e0078356f799dfcf346f3e77095d0c624d2d10cdeaa6e88f469fbb87049\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1b04bb6432aa7ede0fec0fc20a68d9446f453e5c05a3adfd45bf17a6f8b9ebc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d0d9929f02171b1ab4c86941d9f44cb58b54eeb19d2f221229eb30f01bcf7375\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"566ec84294cde50603c3dfa36bdf2a31651f5466d00e709b76f896a26cdc6f50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6bf0b16aa8962b07d84f7048f7b90a0b18983bd80e9edb53eef17bed17344e99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"12b5dd9ded539680a4677101fbb814ed65f93d791dfecc06a4e34ac1ca666285\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3feb12b2847f536be51d0b1e92294157bff9383e20f2265f92e3ea76cb048d9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9b267730031d7c70062f248c5d4811c04b382ca0287062b64928d46b92989d20\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"fd11e09603fe10b92e5b13701b94b1bc51bd77fefaef648e1161701b5fa58e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"68bd4c49aaa83b70448e00df2203ce7ce94bfe9c263e924f642ee7ca2732c5e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"f72767414d30bcfd4e1eb5788ae3b97e09949d30d08ca78756af19a21889315d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"685672fdf62a49b437cb02b0a5cf31117061b1cb305120627a24d822b87448b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"28b61973b7f554ada23df8f2adbcef9c3140a267f58ebf2ee8fb91ca7b72c4a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dac478a38580f45da71c649418701234a58fe64e526cb6afb7481ba444836b2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"36b0f5aa2c414392caa7ffd3bb635d11e950c904103befcfeb425d09f5b9dd48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"90c38ac2efd8fc638edcb5f7c8693ef7a3280fbb60b050b3849a607a39eaf69d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"03f1f356a7d76e767be8c0f275a64f6b98f09a8f3d04640561ef4c3f580d2783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"4402031351082e527488b2a5cccf7d68722dece1fa01370d5c21333ca6505522\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"b9c11f37fe72e97b7a55dae48d999a758e39f367ad7a116d7c28ae2380778fe1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1fae005cfbffbe4e3aaf50dbb8dd3b5a9f584045e1475c7738a315467ec67d5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"135dd5eacaaaeb159be4c9871fe73af3bfd928f5de1be32e147f296965866b96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"336d069594861bb5e759f874cb7b2f97e4c07a0dcd6170a429970f5f2d53ac0b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dfc32b1869457c56bed8d097b7c0a22a2a0b12e527f2acb8733ab9067d057c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e25322c24d98be7252f7c79cda0327987ee6ee4733d332ed5901e1b273397c89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"00bc5328f6973fb2115cb694774124ef334eba1a1cfc7badbab358850a407a44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"1f9f53047b22c1c17c09acdb0fd9c17eb0638398ecc1a9a37a86b01d811cccb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"96d4f3037b42b8b4dbb2b4c60ec972ab8af4ae9746f33d3238fb10f28f178b9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"310e1acfd0057c6e83529a4c7d8365e210e81104c28ddd0e12bf7c27c4f96a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"78c96b65770748aed921a19b6a2bd36cc8321c0a7dec5651a52e25bab7ad2164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dfcdd2ad233477f91e46e790091a8a25cccde3e540e5dfee8a882e70548b396d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"32a037705f978b303327717e1c0ec5e2335c0b26c10797f521b5135cf6a2453a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"e6a99dc788b835aacddb6627c89f73143a475188279769039fa67efd06d375ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9960c39f056ac6bfdf36a15fd9c1fa7c853b27ad278ebc44f7ec6e94d68172d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"7287734b84ceef6341393a90e3ed4982016519f2ef7f9218e0807c5b41fe5f8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"45872a4dc74f3d9c8887e6e6522fcc3828da98c8175226158ad7d1e0d3a30127\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"688f84a7dff8577d0e7ac9a7d4ec36ff7dbdda50d779bc6b57d6aae8ce8b2fa7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"435ffa54404a9fbb884e542d138a68cfb6613f929fac5c1d075c32a78366f2c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"41543e9b40d595358566e7bb5bcbb2fccbbbe2135adcd30f456cbd888d802a5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"4aa7d5ab26c862da3f59d51848309ebfd14dd317c39eeefa3ea8a80838fbb716\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"80cec2e610c1806df05551724b800f012f0c084c1813547c1bbd670985b653f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"74df5489e7dfa47ee79eee83e342918f6531e925cfe1a798956b35da601d884d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"ceac94fca2ae9ea5cc47f3df0ec9d6a10b6251c722a213562fa646ea167dcdce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e619c29e635edd15be7867ccd71c115af280811a435be9acf9042fe6ce2369a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"836cd1aaeda4d6b267aa83969a7f76f361d3884106e3fe9a1a411ebc103c733b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"58317c757c8a458d1a8d6d5b7d8a3528d73c19d945347d61d3167c58a9f2abf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"811ca47fdaa1feef5760290388150e142b3763ef459a60d86cb3e223c6af9a2e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"484761bfa30c42040a68a552fd37e9c6794f6d1979ee07beb44e5d6b81c5f2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"c98397041d5e3535484e38692edcddb66bc94af55a8aefe7b372827b5b9a3658\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__a1e5bb0d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"a43dd8ae0bc04f6d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-de0ea2/maas-trlp-premium-w4-de0ea2\"]}],\"name\":\"df7b3104a100478ba86ef3efa2a83b687d49ec85b07c62e635a293b710028281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3fe8aaa75098b89c44ca3fe5a5cfc62dfa76bcc518cd59e8843f2e901b0a131d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"cfa45a246c21e687ad88a5b47e3484a2e94f500826f168a1b20a49a1094bc73c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-de0ea2"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:30.413Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a","error":"authconfigs.authorino.kuadrant.io \"f27d0c5d53c3a12e56b2dcac4d5edcc07bfeb8457c872d84cc5978936bf8be8a\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4","error":"authconfigs.authorino.kuadrant.io \"d6f362863a967c17a7eee6fe729d1ee52045749978e571d6fffa8e0688b25ba4\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.523Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c","error":"authconfigs.authorino.kuadrant.io \"2b5a947f43772ab8ea6b30829ff32243537c3c485bdfab00ecc022a4de76f17c\" not found"}
{"level":"error","ts":"2026-11-04T01:25:30.780Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-de0ea2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-de0ea2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:31.011Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-de0ea2","namespace":"e2e-models-e2e-worker-w4-de0ea2","uid":"46a3ceb3-a5a7-4d6e-a37f-82724459bd8f","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-de0ea2\" not found"}
{"level":"info","ts":"2026-11-04T01:25:31.315Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:31.315Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:31.388Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w3-11ea30-kserve-route","namespace":"e2e-models-e2e-worker-w3-11ea30","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w3-11ea30-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:31.463Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w4-de0ea2-kserve-route","namespace":"e2e-models-e2e-worker-w4-de0ea2","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w4-de0ea2-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","reconcileID":"7a26c27d-324b-491c-a906-9a1413d5a6b0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","reconcileID":"7a26c27d-324b-491c-a906-9a1413d5a6b0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-047f21","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-047f21","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-b-047f21\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:25:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:25:37.551Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Limitador","EnvoyFilter","Gateway","AuthPolicy","ConfigMap","Kuadrant","AuthConfig","TokenRateLimitPolicy"],"eventTypes":{"delete":20,"update":10}}
{"level":"info","ts":"2026-11-04T01:25:37.691Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:37.711Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:38.648Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:38.713Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:25:38.922Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:25:39.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:25:39.114Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-de0ea2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-de0ea2","reconcileID":"d4f39c14-c5b9-49d1-98f4-498c5390eb67","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w4-de0ea2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:25:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-de0ea2","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:25:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:25:39Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:25:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:25:39Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:25:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-de0ea2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-de0ea2","reconcileID":"d4f39c14-c5b9-49d1-98f4-498c5390eb67","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w4-de0ea2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:25:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-de0ea2","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:25:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:25:40Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w4-de0ea2\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:25:40Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:25:40.351Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:25:40.354Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:40.355Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:40.355Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:40.358Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:25:40.360Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:25:40.473Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:49.683Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\" not found"}
{"level":"error","ts":"2026-11-04T01:25:49.741Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w4-de0ea2","namespace":"openshift-ingress","uid":"d8814649-02b8-4dc7-9a8a-3a2dbc3a35aa","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w4-de0ea2\" not found"}
{"level":"error","ts":"2026-11-04T01:25:50.012Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-047f21-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-047f21-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T01:25:50.319Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:50.319Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:50.382Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-de0ea2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-de0ea2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:50.446Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w4-de0ea2-kserve-route","namespace":"e2e-models-e2e-worker-w4-de0ea2","error":"httproutes.gateway.networking.k8s.io \"premium-w4-de0ea2-kserve-route\" not found"}
{"level":"error","ts":"2026-11-04T01:25:50.448Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w1-e6c59a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:50.578Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-047f21","error":"gateways.gateway.networking.k8s.io \"e2e-inf-b-047f21\" not found"}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-11ea30","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-11ea30","reconcileID":"bddeafa6-43d2-4378-9b85-2456405101c0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w3-11ea30","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:25:51.172Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute"],"eventTypes":{"delete":1}}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-11ea30","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-11ea30","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-11ea30","reconcileID":"bddeafa6-43d2-4378-9b85-2456405101c0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w3-11ea30","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-11ea30","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w3-11ea30\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:25:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:25:53.753Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:53.754Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:25:53.754Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:25:53.758Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:25:53.750Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:25:53.760Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:25:53.806Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-inf-b-047f21","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-b-047f21\" not found"}
{"level":"error","ts":"2026-11-04T01:25:53.860Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-inf-b-047f21","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-b-047f21\" not found"}
{"level":"error","ts":"2026-11-04T01:25:53.864Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:25:53.864Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:25:53.868Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30#rule-2"},"creationTimestamp":"2026-11-04T00:10:26Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:03Z"}],"name":"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d","namespace":"kuadrant-system","resourceVersion":"30504","uid":"632c3619-3851-4df2-a468-fc5aed90f61e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:53.943Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:17:32Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:32Z"}],"name":"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0","namespace":"kuadrant-system","resourceVersion":"37379","uid":"cf482d3e-2129-418c-8a91-c078f655832b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.025Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:11:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:53Z"}],"name":"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0","namespace":"kuadrant-system","resourceVersion":"30257","uid":"9275230c-f5fc-4898-8c1d-25b38084bf0c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.095Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:11:36Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:49Z"}],"name":"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a","namespace":"kuadrant-system","resourceVersion":"30164","uid":"f9135538-4926-4df0-98d4-718a05539f2e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:37Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:37Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.161Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:13:15Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:54Z"}],"name":"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7","namespace":"kuadrant-system","resourceVersion":"31777","uid":"8b01e8db-c823-4e93-9b73-bd99d3a015b5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2#rule-5"},"creationTimestamp":"2026-11-04T00:10:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:49Z"}],"name":"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52","namespace":"kuadrant-system","resourceVersion":"31570","uid":"446c6f10-0573-4634-bd46-bf4df88c4d8b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.296Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:13:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:45Z"}],"name":"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e","namespace":"kuadrant-system","resourceVersion":"31434","uid":"2845ef08-a5f6-4b50-bccc-dee0602e0a6a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.334Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-047f21","envoyfilter":"openshift-ingress/kuadrant-e2e-inf-b-047f21","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-047f21\" not found"}
{"level":"error","ts":"2026-11-04T01:25:54.360Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:13:15Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:46Z"}],"name":"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971","namespace":"kuadrant-system","resourceVersion":"31463","uid":"c4fe6d96-6b55-4a94-926d-826b44249bd1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.426Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:17:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:07Z"}],"name":"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089","namespace":"kuadrant-system","resourceVersion":"36859","uid":"6bcc4345-42f0-4011-8db6-a41dffbcffab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.492Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:17:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:07Z"}],"name":"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057","namespace":"kuadrant-system","resourceVersion":"36855","uid":"57be672f-a363-42a9-a642-6e1c9c687b78"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.559Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:13:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:54Z"}],"name":"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3","namespace":"kuadrant-system","resourceVersion":"31801","uid":"065e6153-2075-4f8e-9f11-d7b5ac08005f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.625Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:12:08Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:47Z"}],"name":"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab","namespace":"kuadrant-system","resourceVersion":"31498","uid":"dc039089-9b40-4c12-ab3c-9097d29b9ed8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.727Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-de0ea2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:10:54Z","generation":11,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"6e7eb8f6-4c81-49df-885a-1cfd92034b41\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:25:25Z"}],"name":"kuadrant-e2e-worker-w4-de0ea2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-de0ea2","uid":"6e7eb8f6-4c81-49df-885a-1cfd92034b41"}],"resourceVersion":"150188","uid":"ad417c34-a43f-49c3-8386-dfcd19d97287"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"8f41f5d27f92196508ddee2fc47e51daf5af5c4825a7e8591ede0800be949fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"f7a4e12ba594de064264e5a79bafadfb910f6fe0c5c088cc1d86aa478feff909\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"545e35b30c59a1aa62ea994b7a5be31f8d3760ca10aeb1ba456d4eea87cf7a6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"a4133ad72b872fc03206a842894304ad17b775369b97a617c5b595bdc943e826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"771078d889ef85b81946eff0b2ff32fbabcda38cbb208fa37bb96509f7d979a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"bba5991046822f1b6e0758327a2491b9658a798d2b607b2a7144f024f0067676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6d451581ca6171a655cb504496641e173bb76b72741c6c02eaed94083a536735\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"46cfece21c467f625b03ba5a104af0b1e8d4a213c5695ef30a112544f1c16cbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9d157bb2d1741f38e7e5854412ecaf7c47f4b489927c97cca666d33d1bb4d834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"a6089be44340b73e309196db9a8c89f042bf2d2570f1e88b8378d364827acdbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d186d8e5e42a867e2a08face337b9772aeae6ba493c896ca867692f02c4456e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"8d1e7b487515ecba92117549552071598f9233e149b32fc4eb13567225116a07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"68a9c4eb18e71677a594352b1b7ad0325a4c685212ace060db3b90da668c6f2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"5cd2749f5fa499321c3a48c9e432951a046807348668fc35fed27b72ac6db3cf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9d55be3daa24118dde3ad2d28e0c6b48c00dd4df682a4745fb2c1e69a0bb735c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d5d96025b93f14012073fc9c61dbf91db95fa9ca2b726ddb91f601e538620862\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"06e46d8eb2da8005de0d157a8845a587567d7612ef6f79fc810ddaf2f78d6bb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"66272d32af643987684100422c0268e207c651a098012b0f2f6c77f68bc6d25f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"84d595c1af2ff8ed9ca0194212a4eeb97f3de15fbf7e225e4c6eb56d5a39f8e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"c13145cd6f1056971233d0e758c11ce8cee133a64eb3cf6a02b122d5a29a71a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"31e47065c52fb96c2470ed21a3d45c533ef5c080afe214081ff5637fa2b0d420\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1b9a9d0030ed877e95dea36c3d55d7589cb8b6b826be9455de9bcdccb31c4a39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"f7db200bfe44cc9433850257d064b4edb5240dd6951e2251e271d79ce2599c45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"042db8e6145979020b4aa2ccc468918dcb1f32d03a1880a86a855cf8560eb16f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"5c91323526e4e1197474b1874d1ec0a636c457a84e2013e3688214b3c9f40292\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"56ff390a2f15a60052acfb6c577c0d99916ec6f8ec0c500a95983e8cd3ea840a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"26bea37b48ab2ee00f259c3b8c9bc4c47b26a86a798c02dc31f2843e47829ca7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"19013eb61834602135d4d3c8ffee368d3060b9b63fc5f9bf0951d431b8c38fdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3b814cb972103fb740b36a5d13d0e90ab61a2243933f933f775c42677c1a5d85\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e7c8f0c364705957418c58fc49a204d16bc88650633ba572edfd632ab77f5666\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"91cab405f0636396c7771c6dc75f806c2ca022fb0848ae3c2fcbb33e22a339ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"67532e0078356f799dfcf346f3e77095d0c624d2d10cdeaa6e88f469fbb87049\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1b04bb6432aa7ede0fec0fc20a68d9446f453e5c05a3adfd45bf17a6f8b9ebc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"d0d9929f02171b1ab4c86941d9f44cb58b54eeb19d2f221229eb30f01bcf7375\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"566ec84294cde50603c3dfa36bdf2a31651f5466d00e709b76f896a26cdc6f50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"6bf0b16aa8962b07d84f7048f7b90a0b18983bd80e9edb53eef17bed17344e99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"12b5dd9ded539680a4677101fbb814ed65f93d791dfecc06a4e34ac1ca666285\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3feb12b2847f536be51d0b1e92294157bff9383e20f2265f92e3ea76cb048d9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9b267730031d7c70062f248c5d4811c04b382ca0287062b64928d46b92989d20\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"fd11e09603fe10b92e5b13701b94b1bc51bd77fefaef648e1161701b5fa58e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"68bd4c49aaa83b70448e00df2203ce7ce94bfe9c263e924f642ee7ca2732c5e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"f72767414d30bcfd4e1eb5788ae3b97e09949d30d08ca78756af19a21889315d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"685672fdf62a49b437cb02b0a5cf31117061b1cb305120627a24d822b87448b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"28b61973b7f554ada23df8f2adbcef9c3140a267f58ebf2ee8fb91ca7b72c4a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dac478a38580f45da71c649418701234a58fe64e526cb6afb7481ba444836b2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"36b0f5aa2c414392caa7ffd3bb635d11e950c904103befcfeb425d09f5b9dd48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"90c38ac2efd8fc638edcb5f7c8693ef7a3280fbb60b050b3849a607a39eaf69d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"03f1f356a7d76e767be8c0f275a64f6b98f09a8f3d04640561ef4c3f580d2783\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"4402031351082e527488b2a5cccf7d68722dece1fa01370d5c21333ca6505522\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"b9c11f37fe72e97b7a55dae48d999a758e39f367ad7a116d7c28ae2380778fe1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1fae005cfbffbe4e3aaf50dbb8dd3b5a9f584045e1475c7738a315467ec67d5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"135dd5eacaaaeb159be4c9871fe73af3bfd928f5de1be32e147f296965866b96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"336d069594861bb5e759f874cb7b2f97e4c07a0dcd6170a429970f5f2d53ac0b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dfc32b1869457c56bed8d097b7c0a22a2a0b12e527f2acb8733ab9067d057c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e25322c24d98be7252f7c79cda0327987ee6ee4733d332ed5901e1b273397c89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"00bc5328f6973fb2115cb694774124ef334eba1a1cfc7badbab358850a407a44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"1f9f53047b22c1c17c09acdb0fd9c17eb0638398ecc1a9a37a86b01d811cccb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"96d4f3037b42b8b4dbb2b4c60ec972ab8af4ae9746f33d3238fb10f28f178b9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"310e1acfd0057c6e83529a4c7d8365e210e81104c28ddd0e12bf7c27c4f96a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"78c96b65770748aed921a19b6a2bd36cc8321c0a7dec5651a52e25bab7ad2164\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"dfcdd2ad233477f91e46e790091a8a25cccde3e540e5dfee8a882e70548b396d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"32a037705f978b303327717e1c0ec5e2335c0b26c10797f521b5135cf6a2453a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e6a99dc788b835aacddb6627c89f73143a475188279769039fa67efd06d375ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"9960c39f056ac6bfdf36a15fd9c1fa7c853b27ad278ebc44f7ec6e94d68172d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"7287734b84ceef6341393a90e3ed4982016519f2ef7f9218e0807c5b41fe5f8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"45872a4dc74f3d9c8887e6e6522fcc3828da98c8175226158ad7d1e0d3a30127\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"688f84a7dff8577d0e7ac9a7d4ec36ff7dbdda50d779bc6b57d6aae8ce8b2fa7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"435ffa54404a9fbb884e542d138a68cfb6613f929fac5c1d075c32a78366f2c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"41543e9b40d595358566e7bb5bcbb2fccbbbe2135adcd30f456cbd888d802a5b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"4aa7d5ab26c862da3f59d51848309ebfd14dd317c39eeefa3ea8a80838fbb716\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"80cec2e610c1806df05551724b800f012f0c084c1813547c1bbd670985b653f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"74df5489e7dfa47ee79eee83e342918f6531e925cfe1a798956b35da601d884d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"ceac94fca2ae9ea5cc47f3df0ec9d6a10b6251c722a213562fa646ea167dcdce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"e619c29e635edd15be7867ccd71c115af280811a435be9acf9042fe6ce2369a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"836cd1aaeda4d6b267aa83969a7f76f361d3884106e3fe9a1a411ebc103c733b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"58317c757c8a458d1a8d6d5b7d8a3528d73c19d945347d61d3167c58a9f2abf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"811ca47fdaa1feef5760290388150e142b3763ef459a60d86cb3e223c6af9a2e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"484761bfa30c42040a68a552fd37e9c6794f6d1979ee07beb44e5d6b81c5f2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"c98397041d5e3535484e38692edcddb66bc94af55a8aefe7b372827b5b9a3658\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/simulator-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"df7b3104a100478ba86ef3efa2a83b687d49ec85b07c62e635a293b710028281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/premium-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"3fe8aaa75098b89c44ca3fe5a5cfc62dfa76bcc518cd59e8843f2e901b0a131d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-w4-de0ea2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-de0ea2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d0a97856\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-de0ea2\"]}],\"name\":\"cfa45a246c21e687ad88a5b47e3484a2e94f500826f168a1b20a49a1094bc73c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-de0ea2/models/e2e/distinct-2-w4-de0ea2')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-de0ea2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-de0ea2\" not found"}
{"level":"error","ts":"2026-11-04T01:25:54.729Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:17:04Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:07Z"}],"name":"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e","namespace":"kuadrant-system","resourceVersion":"36869","uid":"a2286ce1-add6-46e2-b686-ce515b1fa8c9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.794Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:11:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:53Z"}],"name":"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8","namespace":"kuadrant-system","resourceVersion":"30251","uid":"090a5cc6-05a5-404a-abe0-c2c9d3e18878"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:54.860Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:19:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:00Z"}],"name":"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e","namespace":"kuadrant-system","resourceVersion":"39750","uid":"9e450b6e-5c70-4472-900a-3107668dc493"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.004Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30#rule-3"},"creationTimestamp":"2026-11-04T00:10:26Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:43Z"}],"name":"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d","namespace":"kuadrant-system","resourceVersion":"30046","uid":"d855b448-05d4-4497-a5c4-a10a5b879173"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.069Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:11:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:57Z"}],"name":"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4","namespace":"kuadrant-system","resourceVersion":"30332","uid":"5fd75c2d-a8b5-44d5-87dd-c41d87704356"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.142Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:10:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:45Z"}],"name":"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d","namespace":"kuadrant-system","resourceVersion":"30084","uid":"6d879e63-3ac2-4d5e-9e2e-9da87ad1edcb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.209Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:11:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:51Z"}],"name":"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0","namespace":"kuadrant-system","resourceVersion":"30208","uid":"5b200850-d865-44ef-8de4-747fd8cd4405"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.275Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:17:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:02Z"}],"name":"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b","namespace":"kuadrant-system","resourceVersion":"36692","uid":"92eca340-a832-40c0-9184-9442e63e21fd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.340Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2#rule-6"},"creationTimestamp":"2026-11-04T00:10:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:55Z"}],"name":"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3","namespace":"kuadrant-system","resourceVersion":"31825","uid":"c61ea402-9988-4981-9b40-faec90ab7973"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.417Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"}],"name":"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee","namespace":"kuadrant-system","resourceVersion":"37329","uid":"3ff7d911-856c-467a-8b39-d994fa75c516"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.547Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:19:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:06Z"}],"name":"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e","namespace":"kuadrant-system","resourceVersion":"40054","uid":"2b8f5b06-a60a-4e60-b5d4-a324cb1ccaae"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.633Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:12:04Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:40Z"}],"name":"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008","namespace":"kuadrant-system","resourceVersion":"31283","uid":"b22f61ec-0d39-467b-89f4-3807b3ff7072"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.699Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:13:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:46Z"}],"name":"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2","namespace":"kuadrant-system","resourceVersion":"31468","uid":"077d8042-c2c0-4a16-a54a-90665dc63ed1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.767Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:11:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:01Z"}],"name":"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7","namespace":"kuadrant-system","resourceVersion":"30459","uid":"7584ae88-7121-4ee9-b2d3-4ce80f9d7e0b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.838Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:17:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:07Z"}],"name":"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41","namespace":"kuadrant-system","resourceVersion":"36863","uid":"46bf18cf-dbcd-440d-bfde-0fcd8fce8157"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.904Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"}],"name":"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f","namespace":"kuadrant-system","resourceVersion":"37334","uid":"dc7908d9-5dab-4ea8-8de4-535496d69825"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:55.971Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:19:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:01Z"}],"name":"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa","namespace":"kuadrant-system","resourceVersion":"39802","uid":"7c5fbdcc-8861-49b2-b0d0-9dab2bb8574c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.039Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:17:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:07Z"}],"name":"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075","namespace":"kuadrant-system","resourceVersion":"36851","uid":"260cd126-de72-4c2a-a999-c46610f97b29"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.114Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"}],"name":"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6","namespace":"kuadrant-system","resourceVersion":"37339","uid":"a755e51f-d491-4870-8130-93e2ca4b0507"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.182Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:19:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:05Z"}],"name":"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5","namespace":"kuadrant-system","resourceVersion":"39958","uid":"5b537835-58b8-43c3-a698-d98f7cc5af77"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.249Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:19:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:06Z"}],"name":"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0","namespace":"kuadrant-system","resourceVersion":"40048","uid":"295cbb2c-672f-476a-a074-e5028147ca61"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.315Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:15:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:45Z"}],"name":"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec","namespace":"kuadrant-system","resourceVersion":"34744","uid":"c0256140-05ee-4292-b831-89270144b2d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.382Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:11:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:55Z"}],"name":"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4","namespace":"kuadrant-system","resourceVersion":"30285","uid":"4c64df1d-ddb1-4ef8-a1aa-3d11e15b690c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.447Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:11:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:49Z"}],"name":"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894","namespace":"kuadrant-system","resourceVersion":"31582","uid":"10397331-d608-412d-8e7b-32cda70a5bed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.513Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:19:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:06Z"}],"name":"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c","namespace":"kuadrant-system","resourceVersion":"40051","uid":"a0355415-284b-4a23-8dd1-30c7f7c7935d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.579Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:13:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:55Z"}],"name":"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a","namespace":"kuadrant-system","resourceVersion":"31819","uid":"8415f4ca-db6c-441c-910e-b7ff04900a75"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.644Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:11:32Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:51Z"}],"name":"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f","namespace":"kuadrant-system","resourceVersion":"30214","uid":"a0296fa9-2eae-4867-ac32-e0822c978f97"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.716Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:15:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:45Z"}],"name":"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335","namespace":"kuadrant-system","resourceVersion":"34729","uid":"6a99936f-80e9-472b-af87-52e04fb80ad3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.782Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:12:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:55Z"}],"name":"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0","namespace":"kuadrant-system","resourceVersion":"31829","uid":"66fbda81-f68c-41dd-b5d6-b3893a0ffb7d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.847Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:11:59Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:53Z"}],"name":"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb","namespace":"kuadrant-system","resourceVersion":"31750","uid":"670fcdab-8457-449d-92dc-411d7a3a142b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.914Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:17:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:02Z"}],"name":"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6","namespace":"kuadrant-system","resourceVersion":"36719","uid":"c57aa0c6-8c28-42c4-9ffe-b3067d8a8402"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:56.981Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:15:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:45Z"}],"name":"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14","namespace":"kuadrant-system","resourceVersion":"34754","uid":"5f121463-70f1-494c-8f72-c4e8a90fae39"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.046Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:11:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:55Z"}],"name":"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1","namespace":"kuadrant-system","resourceVersion":"30282","uid":"1c40e35d-dd40-4e1b-ac01-52bdb4687891"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.112Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:19:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:04Z"}],"name":"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef","namespace":"kuadrant-system","resourceVersion":"39905","uid":"2a60a494-f4da-4722-8342-3b4a59015872"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.183Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:11:02Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:02Z"}],"name":"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74","namespace":"kuadrant-system","resourceVersion":"30471","uid":"d0add022-a161-42ac-9544-fd8c33a27a09"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.248Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30#rule-4"},"creationTimestamp":"2026-11-04T00:10:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:47Z"}],"name":"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e","namespace":"kuadrant-system","resourceVersion":"30110","uid":"d26c08f1-1feb-4645-8af1-04ce0d1a25b5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.314Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:13:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:50Z"}],"name":"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc","namespace":"kuadrant-system","resourceVersion":"31622","uid":"ee2ceb34-e409-4501-91d8-a9f2a6982f2c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.380Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:10:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:58Z"}],"name":"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b","namespace":"kuadrant-system","resourceVersion":"30347","uid":"00826fcd-8020-4257-a3b8-e023af30872a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.446Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:12:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:45Z"}],"name":"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab","namespace":"kuadrant-system","resourceVersion":"31416","uid":"ecf3a204-22fa-4e97-ba47-6a617c2a73f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.511Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:13:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:49Z"}],"name":"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c","namespace":"kuadrant-system","resourceVersion":"31607","uid":"8d569460-db85-4ce2-9dd3-325de9087a5d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.576Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:32Z"}],"name":"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380","namespace":"kuadrant-system","resourceVersion":"37381","uid":"67a753f2-ed01-4890-9171-adda706e124b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.643Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:17:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:07Z"}],"name":"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f","namespace":"kuadrant-system","resourceVersion":"36871","uid":"ac3a18a7-ed39-4a44-a289-74afdc7d60f1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.708Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:11:03Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:59Z"}],"name":"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027","namespace":"kuadrant-system","resourceVersion":"30401","uid":"79eb55ab-fd7a-4abb-9ad6-2c07ca7afa51"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.774Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:11:36Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:00Z"}],"name":"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273","namespace":"kuadrant-system","resourceVersion":"30428","uid":"1208ebc2-0d5d-4957-851f-23e9d352b602"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:37Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:37Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.840Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:19:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:00Z"}],"name":"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38","namespace":"kuadrant-system","resourceVersion":"39753","uid":"110d4090-0507-4650-8b20-e1ac2450a343"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.906Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2#rule-1"},"creationTimestamp":"2026-11-04T00:10:57Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:51Z"}],"name":"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b","namespace":"kuadrant-system","resourceVersion":"31679","uid":"956fd4d6-dc23-49e3-a0ae-714a269f21cc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:57.972Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30#rule-5"},"creationTimestamp":"2026-11-04T00:10:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:46Z"}],"name":"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166","namespace":"kuadrant-system","resourceVersion":"30101","uid":"0093c8ab-7b85-4367-825f-2a704cb76da6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.038Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:15:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:46Z"}],"name":"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3","namespace":"kuadrant-system","resourceVersion":"34769","uid":"67efba88-c545-44d5-848f-c47c9e54411f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:13:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:42Z"}],"name":"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44","namespace":"kuadrant-system","resourceVersion":"31347","uid":"e786b0a1-f33a-4605-9fb0-135455742e4f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.170Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:11:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:58Z"}],"name":"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66","namespace":"kuadrant-system","resourceVersion":"30354","uid":"5fd70e8c-ccc6-4a78-9e0a-6aea1132e8b3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.236Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2#rule-3"},"creationTimestamp":"2026-11-04T00:11:02Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:49Z"}],"name":"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e","namespace":"kuadrant-system","resourceVersion":"31567","uid":"6ea3d6f9-1bb7-493a-82a5-e99f2f82d6fb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.302Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:17:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:04Z"}],"name":"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed","namespace":"kuadrant-system","resourceVersion":"36766","uid":"77dd2f83-399c-4480-8c66-6054e8d27ade"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.368Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:12:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:52Z"}],"name":"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af","namespace":"kuadrant-system","resourceVersion":"31696","uid":"2f905633-c53d-46f6-bba4-64daccb0f38b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.435Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:15:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:44Z"}],"name":"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340","namespace":"kuadrant-system","resourceVersion":"34720","uid":"56f3c6c8-92ea-49c2-bb2e-f7e337ef20d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.500Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:19:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:06Z"}],"name":"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128","namespace":"kuadrant-system","resourceVersion":"40062","uid":"861aa9aa-41d9-40ea-8c6f-85a5076b13e0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.565Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:15:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:44Z"}],"name":"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1","namespace":"kuadrant-system","resourceVersion":"34701","uid":"37731d35-38a3-4b3f-a7d5-94a7719665f9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.631Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:15:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:45Z"}],"name":"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c","namespace":"kuadrant-system","resourceVersion":"34736","uid":"b12f1299-7d2f-47e6-824f-514871c0829c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.698Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:32Z"}],"name":"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad","namespace":"kuadrant-system","resourceVersion":"37377","uid":"c5617b2b-a944-433e-9ab2-f67f8adeda3d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.765Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"}],"name":"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8","namespace":"kuadrant-system","resourceVersion":"37341","uid":"e86fe1e7-3cb2-4d49-bb21-e2d14d5c1727"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.830Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:19:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:00Z"}],"name":"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267","namespace":"kuadrant-system","resourceVersion":"39768","uid":"8aecc09a-a1f5-4245-800a-34b05d0f91ae"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.896Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:11:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:47Z"}],"name":"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9","namespace":"kuadrant-system","resourceVersion":"30120","uid":"4d051944-fba1-4edb-b394-f6cb7a2e1084"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:58.972Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30#rule-1"},"creationTimestamp":"2026-11-04T00:10:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:48Z"}],"name":"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a","namespace":"kuadrant-system","resourceVersion":"30129","uid":"4188b0d8-6c85-4a1e-9609-1be3a55ace29"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.042Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:11:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:57Z"}],"name":"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba","namespace":"kuadrant-system","resourceVersion":"30324","uid":"a136b564-0b2c-497f-9a17-528600383a4c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.107Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:12:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:48Z"}],"name":"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676","namespace":"kuadrant-system","resourceVersion":"31547","uid":"10bf24da-9ebe-4676-8f7e-d9e1e26a5714"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.175Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:17:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:02Z"}],"name":"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190","namespace":"kuadrant-system","resourceVersion":"36709","uid":"ac021ec7-4be2-4046-92cc-84889c0751b0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.241Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-11ea30#rule-6"},"creationTimestamp":"2026-11-04T00:10:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:49Z"}],"name":"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3","namespace":"kuadrant-system","resourceVersion":"30171","uid":"1a35c92f-a979-4525-97b7-011d52f3c894"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.306Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:12:03Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:46Z"}],"name":"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47","namespace":"kuadrant-system","resourceVersion":"31442","uid":"f565b332-68bb-4993-8648-b79c0b9cb2bb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.371Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-04T00:15:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:45Z"}],"name":"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5","namespace":"kuadrant-system","resourceVersion":"34739","uid":"97a8d471-2c8d-4959-84aa-5b7bcf9a0b0c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.436Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-04T00:10:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:53Z"}],"name":"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54","namespace":"kuadrant-system","resourceVersion":"30237","uid":"4b5e4939-b70d-49dd-8824-76f6fe716513"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.501Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:15:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:45Z"}],"name":"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209","namespace":"kuadrant-system","resourceVersion":"34726","uid":"b5869be4-505f-414c-8084-2edb18f271bc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.566Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:19:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:02Z"}],"name":"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f","namespace":"kuadrant-system","resourceVersion":"39817","uid":"bf61dc73-797b-4cf6-86f6-0c1e454d090d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.631Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2#rule-2"},"creationTimestamp":"2026-11-04T00:10:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:42Z"}],"name":"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa","namespace":"kuadrant-system","resourceVersion":"31361","uid":"f2ef0261-0d5f-4c55-8410-7fe0bb3415f9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.696Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"}],"name":"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb","namespace":"kuadrant-system","resourceVersion":"37326","uid":"18b6b251-1ce7-46da-b4c3-ca9a8aae0e19"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.762Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:32Z"}],"name":"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160","namespace":"kuadrant-system","resourceVersion":"37364","uid":"ad143254-10ce-443e-ab1f-3a6073b0a7ea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.826Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:11:59Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:55Z"}],"name":"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae","namespace":"kuadrant-system","resourceVersion":"31822","uid":"fc99ee90-9ca2-445a-9cdf-c33ce28c121d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.893Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:17:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:02Z"}],"name":"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90","namespace":"kuadrant-system","resourceVersion":"36724","uid":"b7eafb3a-5424-4e54-a3f2-5fd84cb28edb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:25:59.958Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:17:32Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:32Z"}],"name":"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50","namespace":"kuadrant-system","resourceVersion":"37375","uid":"d69699dc-61f0-440c-83d5-1464fcb6a2e6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.023Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-04T00:15:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:45Z"}],"name":"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22","namespace":"kuadrant-system","resourceVersion":"34733","uid":"af4efb07-881f-4000-95dd-3fc066f1a88b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.088Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-04T00:10:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:54Z"}],"name":"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25","namespace":"kuadrant-system","resourceVersion":"30267","uid":"b8f0760e-6654-4188-ab76-bce88593749e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.153Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:32Z"}],"name":"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd","namespace":"kuadrant-system","resourceVersion":"37373","uid":"8d087731-c166-488c-883e-e5ab6113bdae"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.221Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:11:03Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:52Z"}],"name":"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e","namespace":"kuadrant-system","resourceVersion":"30220","uid":"f64804b1-016d-4618-b4b9-c3f70272915c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.287Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:10:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:44Z"}],"name":"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4","namespace":"kuadrant-system","resourceVersion":"30062","uid":"6bd2eb41-5155-4b88-b238-f5691dd84e7f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.352Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-w4-de0ea2-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-04T00:17:31Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:31Z"}],"name":"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e","namespace":"kuadrant-system","resourceVersion":"37324","uid":"3ba20b38-50ad-45e9-b6d4-3f0b89158315"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.418Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:10:54Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:55Z"}],"name":"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea","namespace":"kuadrant-system","resourceVersion":"30296","uid":"f1f17714-2e57-43bb-a473-12beb5559f4a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:10:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:10:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.484Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:11:58Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:44Z"}],"name":"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf","namespace":"kuadrant-system","resourceVersion":"31411","uid":"229103a5-b738-461c-b9e0-4dfc17465553"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.549Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-04T00:13:15Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:53Z"}],"name":"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86","namespace":"kuadrant-system","resourceVersion":"31738","uid":"17507fd4-da45-47fe-a020-eacf4858481b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.614Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:15:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:45Z"}],"name":"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972","namespace":"kuadrant-system","resourceVersion":"34752","uid":"3919f0ce-6e7d-4765-aaf0-696111ccfbbb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.681Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-de0ea2#rule-4"},"creationTimestamp":"2026-11-04T00:10:59Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:43Z"}],"name":"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416","namespace":"kuadrant-system","resourceVersion":"31383","uid":"34fa5dcc-8996-4f08-99c7-5b49a8dbfd04"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.746Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:13:15Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:51Z"}],"name":"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340","namespace":"kuadrant-system","resourceVersion":"31689","uid":"c454ed36-b234-4896-bf60-185af98fe94b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.811Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-w3-11ea30-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-04T00:15:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:15:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:15:44Z"}],"name":"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0","namespace":"kuadrant-system","resourceVersion":"34712","uid":"52949a74-1ff7-46ad-833b-b9293b426624"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:15:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:15:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.876Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/distinct-2-w4-de0ea2-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-04T00:19:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:19:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:19:00Z"}],"name":"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492","namespace":"kuadrant-system","resourceVersion":"39763","uid":"1e262b2f-ab17-46fb-b1fc-ef5fc0b71cf5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:19:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:19:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:00.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/premium-w4-de0ea2-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:13:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:50Z"}],"name":"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e","namespace":"kuadrant-system","resourceVersion":"31652","uid":"d207b3b3-f754-46c9-bb3e-03f6d49da2e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:13:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:13:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:01.006Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-de0ea2/simulator-w4-de0ea2-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:11:59Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:13:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:13:48Z"}],"name":"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7","namespace":"kuadrant-system","resourceVersion":"31517","uid":"bed258cc-3012-45ba-a2b5-13671cab04f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-de0ea2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:01.075Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/distinct-2-w3-11ea30-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-04T00:17:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:17:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:17:02Z"}],"name":"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735","namespace":"kuadrant-system","resourceVersion":"36722","uid":"e831daec-2449-4688-a3f6-d1314bea6d83"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:17:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:01.140Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/premium-w3-11ea30-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-04T00:11:36Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:42Z"}],"name":"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5","namespace":"kuadrant-system","resourceVersion":"30013","uid":"471bf7ee-6fb2-470f-a341-53f0760a419e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:11:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:11:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:01.205Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-11ea30/simulator-w3-11ea30-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-04T00:10:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:12:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-04T00:12:42Z"}],"name":"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1","namespace":"kuadrant-system","resourceVersion":"30035","uid":"eb1524e9-9b21-4708-bc8b-84c4ce7e8551"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-11ea30.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-04T00:12:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-04T00:12:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:01.260Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b32e3e3179c8a47858f894ead7a8edda326b68ece2835880b4e91d10a2e5ef21","error":"authconfigs.authorino.kuadrant.io \"b32e3e3179c8a47858f894ead7a8edda326b68ece2835880b4e91d10a2e5ef21\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.317Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/72b09fbd9717a531761117e8a137c042ea24289b5ac302a96ee4aecedbe123ac","error":"authconfigs.authorino.kuadrant.io \"72b09fbd9717a531761117e8a137c042ea24289b5ac302a96ee4aecedbe123ac\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.372Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ab7f9daf61f4b9a1a0524772716f8d4e8cc444346633083f3bbe60224de5b5da","error":"authconfigs.authorino.kuadrant.io \"ab7f9daf61f4b9a1a0524772716f8d4e8cc444346633083f3bbe60224de5b5da\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.426Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5369fb14b4c9747fff329b6d22b318dd96b34aaaf0bd9f2df40bf15e7f913b79","error":"authconfigs.authorino.kuadrant.io \"5369fb14b4c9747fff329b6d22b318dd96b34aaaf0bd9f2df40bf15e7f913b79\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.481Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e0525c4c0827a4fa7a2054dbb397d0948b85f8ca7bacfc94f5663dd80f43acf2","error":"authconfigs.authorino.kuadrant.io \"e0525c4c0827a4fa7a2054dbb397d0948b85f8ca7bacfc94f5663dd80f43acf2\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.536Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/966a3b89b25f42fa12afb1fa01a22d057abc3a21a8ec51e3d0f3c83c63e49d9c","error":"authconfigs.authorino.kuadrant.io \"966a3b89b25f42fa12afb1fa01a22d057abc3a21a8ec51e3d0f3c83c63e49d9c\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.593Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-11ea30","namespace":"e2e-models-e2e-worker-w3-11ea30","uid":"2aae4e84-5a9d-4d34-8a01-173e49a91f1d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-11ea30\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.819Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-de0ea2-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-worker-w4-de0ea2-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.830Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w3-11ea30","namespace":"openshift-ingress","uid":"3e40b1ed-88c8-475d-ba5f-0f7cf154dfc7","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w3-11ea30\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.878Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-047f21-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-047f21-maas-auth\" not found"}
{"level":"error","ts":"2026-11-04T01:26:01.954Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w4-de0ea2","namespace":"openshift-ingress","uid":"d8814649-02b8-4dc7-9a8a-3a2dbc3a35aa","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w4-de0ea2\" not found"}
{"level":"error","ts":"2026-11-04T01:26:02.103Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w3-11ea30-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w3-11ea30-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:26:02.198Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:02.198Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:26:02.259Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w4-de0ea2-kserve-route","namespace":"e2e-models-e2e-worker-w4-de0ea2","error":"httproutes.gateway.networking.k8s.io \"premium-w4-de0ea2-kserve-route\" not found"}
{"level":"info","ts":"2026-11-04T01:26:07.735Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","Kuadrant","ConfigMap","HTTPRoute","Gateway","Limitador","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":1,"delete":30,"update":114}}
{"level":"info","ts":"2026-11-04T01:26:07.870Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:07.890Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:08.429Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:26:08.452Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:26:08.519Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:26:08.519Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:08.564Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:09.148Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:09.151Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:09.151Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:09.152Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:09.155Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:26:09.156Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:26:09.262Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:26:09.262Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:17.702Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:17.703Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:18.215Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Gateway"],"eventTypes":{"delete":4}}
{"level":"info","ts":"2026-11-04T01:26:19.337Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:19.340Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:19.344Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:26:19.346Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:19.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:19.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:26:19.414Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"231f3b62557e11b27e99fd29a33ce5524114231bffc4eeb59318f5bab7d70ae6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["231f3b62557e11b27e99fd29a33ce5524114231bffc4eeb59318f5bab7d70ae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"231f3b62557e11b27e99fd29a33ce5524114231bffc4eeb59318f5bab7d70ae6\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:19.452Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:26:19.452Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:26:19.488Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"224097b0dfb71499685ab7f8fe6d05d16c9517ffdb6216c079091b2a3770a0bf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["224097b0dfb71499685ab7f8fe6d05d16c9517ffdb6216c079091b2a3770a0bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"224097b0dfb71499685ab7f8fe6d05d16c9517ffdb6216c079091b2a3770a0bf\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:19.564Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"af167fabecd8c2d69edb1fe4b738f7ab8c86cdbfb66bb756c239433a8f82edd4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["af167fabecd8c2d69edb1fe4b738f7ab8c86cdbfb66bb756c239433a8f82edd4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"af167fabecd8c2d69edb1fe4b738f7ab8c86cdbfb66bb756c239433a8f82edd4\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:19.639Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"69ef9cea148c9fedea3825fd0bebee47f2d82bbcd6b96f250382551b64fbcbd1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["69ef9cea148c9fedea3825fd0bebee47f2d82bbcd6b96f250382551b64fbcbd1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"69ef9cea148c9fedea3825fd0bebee47f2d82bbcd6b96f250382551b64fbcbd1\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:19.719Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"232dbc65e4661f553a43407c8b1632d53a5e60081eb90e0bfa5ee14e77cb359d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["232dbc65e4661f553a43407c8b1632d53a5e60081eb90e0bfa5ee14e77cb359d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"232dbc65e4661f553a43407c8b1632d53a5e60081eb90e0bfa5ee14e77cb359d\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:19.795Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"489bdfbe8dc5f584b15844c121c054ace42cbc33487932cc8aa651d24fa03025","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["489bdfbe8dc5f584b15844c121c054ace42cbc33487932cc8aa651d24fa03025"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"489bdfbe8dc5f584b15844c121c054ace42cbc33487932cc8aa651d24fa03025\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:19.868Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"64b2028544f23572f2dcc005c138e24d1362d082aac15097379af0850e439930","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["64b2028544f23572f2dcc005c138e24d1362d082aac15097379af0850e439930"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"64b2028544f23572f2dcc005c138e24d1362d082aac15097379af0850e439930\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:19.914Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-e6c59a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:48:42Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5ade722c-b227-4494-8769-73c06bb9dc7e\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T00:58:14Z"}],"name":"kuadrant-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w1-e6c59a","uid":"5ade722c-b227-4494-8769-73c06bb9dc7e"}],"resourceVersion":"108237","uid":"45fb25e8-fa6f-4f9d-be30-a043bd501a05"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"6b07cc21235a6b80d2fe4ed5e4a052f0cd0b7a953d0846a4378d7bb3818a0c82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"83585a7c475f3f477aa9e915a26d34cf82fb580485f28446ababd4f9fe696ee6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"e14afa3546e293358c36835d2bfcab543d19dfb8f42a3aad8fad60d3a1c62853\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"8926bce2e2e09c871b17806bf64c0a5e69e709d9a2c0851fe4feccf15dbb1663\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"bf421279f098b938d12226ca39e102ce55ba0d7526d93f1df15996fc56f3a2a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"8841026edf5b38d2c242a2bc89dbc72d188dc230d5b1b62513adeebe11a5248e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"51c88d90c4e9113f7548bc5771ef5f41e32e9d4ea17e67bf747090c809fd3cca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"26989a67c6ef3f51c6e2c81dff963c7a4e709b54f4a04e8c4dc232a4fb431d0b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"314672513711dee5adf50319e2d21cf21916637b1af195669f8677efcd77cfdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"d93e0d81582ca025fa16280a90ed0053ccf4d3bfd0ad56d0c775a2a8f02804e7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af167fabecd8c2d69edb1fe4b738f7ab8c86cdbfb66bb756c239433a8f82edd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"378865cc21a60c646878ef73261ed3c25f5c675dc74f6b5b94e4ef6818c3f42b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a6177ed0627a93ac12974df31cb0fa9c662bd868ee9b944b37ba973d0c5dfcc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"99728e76833f99c8dbeef3829b7ad59a0364d1b6ac0edda2c53c1770f621346f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64b2028544f23572f2dcc005c138e24d1362d082aac15097379af0850e439930\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"bb3d5e1668e06298e41819ad43e94c7c481443ef575461f6544f2baa4982fd87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0c30b4d6afba0acf6a8e74f09b3c3f6d4c56d39c34fbb4d67347d082d846f85b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"189c2693860584f7fc06359e14eaf80928d18c0a5fd963f3379c8dd3cdde56f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"489bdfbe8dc5f584b15844c121c054ace42cbc33487932cc8aa651d24fa03025\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"b130f7b871f2704f5c94972343be30db6b97361a8524e30738b365e560b3cbae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb87acf937093aeff42342e8a6fecb473a36a5c207575d6d42c0ed1346337ef1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"2a61556cae5f0d50f31a9da5bdd56c71744f69365cecfe662c38286384af97bf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"232dbc65e4661f553a43407c8b1632d53a5e60081eb90e0bfa5ee14e77cb359d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"4a9b02e65e8f17dc5c38e9490f928bf893f46333c788521e074dd107f888b3c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb8c4f04ac3671f5c7cd770696188a59242df171b4207c0cf596ce44c6eca30e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"c67cc898ca9ddf1ff0d672825a6c573410890f1f76cba9ec875fa127dd92d05a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69ef9cea148c9fedea3825fd0bebee47f2d82bbcd6b96f250382551b64fbcbd1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"feb81f13cfb2a1c8dfb66c316eea533e3ef9e19c9bd8ad9992c3633b1c22d5e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"231f3b62557e11b27e99fd29a33ce5524114231bffc4eeb59318f5bab7d70ae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"fc5c4ecb6ea67c00c8d7af5403973b581b9ae325ac0314be186d7de268dde4cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69a5c4ae27dc8e859a4559f7ab87a64047c4bfc814feb1cad3797354fa1ec640\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"6a0d797d1227aea5a12ff538434df469ef05a7ee401db7c39bb0fa7ad123fc05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d510d6bf0d02874963a62f4afffe682ebeae86d1b80d2d425407ccc8c330178\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"347354855c1cdb5b67fa9f1d8a7f959defe6cae096340721398863336ae3ed34\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"49e148bcf8f3bd2320a8439c08fcf37e06f12f8a4f69ec3c353f67550d3c27f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"c938cec593e991bc11fb1e3e7d118212dd2cb0dfc7e2c72afa98668a7d51f0ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"42536036e7512c2feb811866135cccb636f11d9d8e3893b6c36572e31a8f7ae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"4819524beeef438ba69edd6a29f6fd07038bd94a981aa7439997d5794bbe247c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9adcdbd5184b289f728f65383fd5d52ff78e1bc7d5611b2e6cf173973bdeead9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-e6c59a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"ed40a51de12529d09ac83585257509f6204e9180065f98bcb699f8c7c0e8ed89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"224097b0dfb71499685ab7f8fe6d05d16c9517ffdb6216c079091b2a3770a0bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-e6c59a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d86d362c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-e6c59a\"]}],\"name\":\"d86a466be9926345895245314976731f009c57ecc6ec75728537f16ddfa1d57d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w1-e6c59a/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w1-e6c59a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w1-e6c59a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:26:19.944Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1a6177ed0627a93ac12974df31cb0fa9c662bd868ee9b944b37ba973d0c5dfcc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1a6177ed0627a93ac12974df31cb0fa9c662bd868ee9b944b37ba973d0c5dfcc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1a6177ed0627a93ac12974df31cb0fa9c662bd868ee9b944b37ba973d0c5dfcc\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:20.018Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0c30b4d6afba0acf6a8e74f09b3c3f6d4c56d39c34fbb4d67347d082d846f85b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0c30b4d6afba0acf6a8e74f09b3c3f6d4c56d39c34fbb4d67347d082d846f85b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0c30b4d6afba0acf6a8e74f09b3c3f6d4c56d39c34fbb4d67347d082d846f85b\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:20.089Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c4aef690e32f81ae5d56e12f3f6b50fe97cd8e8b238f385567bbb79f1718e65e\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:20.160Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cb87acf937093aeff42342e8a6fecb473a36a5c207575d6d42c0ed1346337ef1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cb87acf937093aeff42342e8a6fecb473a36a5c207575d6d42c0ed1346337ef1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cb87acf937093aeff42342e8a6fecb473a36a5c207575d6d42c0ed1346337ef1\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:20.234Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w1-e6c59a/sub-test-model-e6c59a-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cb8c4f04ac3671f5c7cd770696188a59242df171b4207c0cf596ce44c6eca30e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/60bd7"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cb8c4f04ac3671f5c7cd770696188a59242df171b4207c0cf596ce44c6eca30e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-e6c59a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cb8c4f04ac3671f5c7cd770696188a59242df171b4207c0cf596ce44c6eca30e\" already exists"}
{"level":"error","ts":"2026-11-04T01:26:20.289Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0","error":"authconfigs.authorino.kuadrant.io \"70cf9ec00ceb687ed67bf1b3c6a2e30f90a3a4a0cb3fb33b8a64b0fe6b746bb0\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.345Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340","error":"authconfigs.authorino.kuadrant.io \"93fb93edd6c747e14a7d566b862a598559b45a63fbd19e73eac6ee6f2fceb340\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.400Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0","error":"authconfigs.authorino.kuadrant.io \"76536be49f20f3be4d29cc3941896a9101f845a15ca332ccbab2b820ebbfddb0\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.472Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd","error":"authconfigs.authorino.kuadrant.io \"3ce28405d3d6c23a0f5d73ee86ecfba28a3fd10a6b38294a75a77e7afe792cfd\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.528Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14","error":"authconfigs.authorino.kuadrant.io \"2aecf7d143d7a188c22eb29a2ff8a421f1f62298952132e3905776f325efbc14\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.588Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b","error":"authconfigs.authorino.kuadrant.io \"0ebd3ae562bbb3ddf732b84c922a64343d5cfd63d38e32e613c1eec1bbfd028b\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.644Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab","error":"authconfigs.authorino.kuadrant.io \"cc6244196bf6c429dd3984e307786229db2b71fee6e14c16111d8b08e92e04ab\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.701Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc","error":"authconfigs.authorino.kuadrant.io \"79d8d22cb774c7c0a2cb22a1270e19be4b0e74e5124c2bfd70c8538a2b5518dc\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.757Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f","error":"authconfigs.authorino.kuadrant.io \"80cd8487cbc15ba761e7347ea4a0755eb47426b205420e7f771edbdb65dc6a8f\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.811Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089","error":"authconfigs.authorino.kuadrant.io \"4a43ece9e56b345c4df4b2f4eb2c98643523717dab683d509bebd561e39b5089\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.866Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057","error":"authconfigs.authorino.kuadrant.io \"f4cf2c202f7d2830ddcab6ab87faf2ced182c21eb1aed0ec07b202a4d8edf057\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.921Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b","error":"authconfigs.authorino.kuadrant.io \"50e1e0ed75d9a12413f502caf2bf473e62b98f8ecdc3d10fabc1f91a6fbb0c5b\" not found"}
{"level":"error","ts":"2026-11-04T01:26:20.976Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e","error":"authconfigs.authorino.kuadrant.io \"2efca5dcda57db6463040bf3b6149c93534ee32341502072979bc836fbca990e\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.031Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d","error":"authconfigs.authorino.kuadrant.io \"01ed7cbe385a37efc7856c8d00c7a09dfc48247eacbf9024d47646e38f38016d\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.086Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3","error":"authconfigs.authorino.kuadrant.io \"c11b1f907524c288a12bfd7e824b536e812b6064e73fb5fb7277f191e22b1ea3\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.141Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5","error":"authconfigs.authorino.kuadrant.io \"ac09ba9183651ac28ccf1b94c31a5fd116eb1817faff751e311c71655a960ae5\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.197Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0","error":"authconfigs.authorino.kuadrant.io \"d029cf6a4e508aade5478cec98e156d2f29223e186d012bfaedbf506f93732e0\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.252Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa","error":"authconfigs.authorino.kuadrant.io \"c9c8e778f08bcd95a481f4a0d06d54e8dcea4311dc4c0b4d5efd20449c8fb8fa\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.309Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66","error":"authconfigs.authorino.kuadrant.io \"f42dc4e0cd1dc63fa8e807184621c084e478b510ac86158ced125e92c401ae66\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.365Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027","error":"authconfigs.authorino.kuadrant.io \"7d8e63b3abf26be608dc57874a421bd4810e87a7bd474893406159766bd8e027\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.419Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416","error":"authconfigs.authorino.kuadrant.io \"2fd3ac42e3a0791d51bee6d72e7c24918887e6264b527d8ae28666c05bca3416\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.474Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972","error":"authconfigs.authorino.kuadrant.io \"94f1200a629129b8d047cf1f7243170d173cfd9f93a03dc1f9eae1565b54b972\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.533Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160","error":"authconfigs.authorino.kuadrant.io \"a2a4777125ddcd83ec0644f967fc5aa2c71a001a183037a55abe34ac93bc6160\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.587Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52","error":"authconfigs.authorino.kuadrant.io \"f74fd861569597c9e19dedc51864618e0c916e5de7d61312f51cd6b36d669f52\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.642Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec","error":"authconfigs.authorino.kuadrant.io \"3ba4160c03b4ab08a9391e766cd59b005b2a74a11aeda99838bd14150dc7e0ec\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.698Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7","error":"authconfigs.authorino.kuadrant.io \"82deaf02e16d628f64bc85260edb73467dad7a3490cd8c3cc9a91766eba52dd7\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.752Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb","error":"authconfigs.authorino.kuadrant.io \"aaa48bcd28f16ca5dce5b52ea88861b7e196c798e8c8f7c9ef5fd9d64e80eabb\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.807Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c","error":"authconfigs.authorino.kuadrant.io \"fc8b61c5b86b8a2a27899b9dfe243bb0d9304e70e2e4184ec3a84c91e53a307c\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.865Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea","error":"authconfigs.authorino.kuadrant.io \"e9063f4970f6298cd516fad7af686c927c2a9c4d169ad59358df3c1e03cd6eea\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.921Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9","error":"authconfigs.authorino.kuadrant.io \"022679d74908e32b3d7dbeeae12815f6f4923617f343059f5053682f62c456f9\" not found"}
{"level":"error","ts":"2026-11-04T01:26:21.976Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f","error":"authconfigs.authorino.kuadrant.io \"4c32232afa5649719c41422550a19a1ec6ae78dc373ebaf320a38fefd267290f\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.032Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075","error":"authconfigs.authorino.kuadrant.io \"8e315c335841bd306a87dfbd0c177e3b57a20f03505813877bd18b2d8e944075\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.087Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4","error":"authconfigs.authorino.kuadrant.io \"998f1bca9fe68e11a26c566338247c11d4467febe2f1e988099d147780c11bf4\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.141Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a","error":"authconfigs.authorino.kuadrant.io \"946cf7a4b7a5db9a82fce51d3b3106ce767defdf29f9db08bdd02325eb27b68a\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.200Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e","error":"authconfigs.authorino.kuadrant.io \"0810cfc144864a46d57ba9678e88eba118535d8c50f79b205cdad459a953804e\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.256Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2","error":"authconfigs.authorino.kuadrant.io \"303765bc7fbdc563c8af53ebbbceb7da9384000e5e8621254083acd6eac502a2\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.313Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5","error":"authconfigs.authorino.kuadrant.io \"16ba5dbe8de04554c56b65a4bc050867ac76b8a817135cf03b4ea83e26c3b0d5\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.373Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44","error":"authconfigs.authorino.kuadrant.io \"2d50ea578ce5dd41173e8ea6cfe5740f83ca81029325afab1645021171d36e44\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.427Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb","error":"authconfigs.authorino.kuadrant.io \"ea24d8b63e78699aa798825ba28efc9a716cd4b8f16ac52e6417e893ba7fc9fb\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.482Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf","error":"authconfigs.authorino.kuadrant.io \"d1cf7b8df0d94c3f43abfaff1436f26265e20fecf547d3ed37601f250cc337cf\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.536Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1","error":"authconfigs.authorino.kuadrant.io \"21eddbd992fdfe65e8f42bd7cb8bf7533eb5a4703d396430edfa6aaa48feb8b1\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.591Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008","error":"authconfigs.authorino.kuadrant.io \"62a5521871313a063b24478a33b8e4b12c465b467b0818d538b70ab3e9b5b008\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.653Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed","error":"authconfigs.authorino.kuadrant.io \"5d3e8ca4f0fa2071d6678cbd19cb09330357931827e6c0b024666fbd877db8ed\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.712Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0","error":"authconfigs.authorino.kuadrant.io \"83659f4dd24a602cb92878b8dfd20cdea5567e3d465dc187cea7d0d9f8aa35e0\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.766Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340","error":"authconfigs.authorino.kuadrant.io \"9cbeb0c751b3a41b9423be8fd53b52f0fe7503c16391e3c8a56700e3c5a10340\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.824Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3","error":"authconfigs.authorino.kuadrant.io \"1223d928354b9365568968fe20252a5fceab5d32573d20f642401d124bff8bf3\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.886Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4","error":"authconfigs.authorino.kuadrant.io \"0e50442a8e7dbcfc055b4d4adfd16ad42faae4e4263d8cbcce9598d874de14a4\" not found"}
{"level":"error","ts":"2026-11-04T01:26:22.940Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0","error":"authconfigs.authorino.kuadrant.io \"e5691396f1bf3c44c97b0271177b2876b9f3b1d655980cc7b2217009f822b2f0\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.001Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae","error":"authconfigs.authorino.kuadrant.io \"16339ccf6050b76e4d5865ea31bec31b283f998d5c737f8c295accca66bf55ae\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.056Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e","error":"authconfigs.authorino.kuadrant.io \"1285322477f681a1f0ee3696e783073289de1c4ca1a828c190f186d90824727e\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.111Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c","error":"authconfigs.authorino.kuadrant.io \"214e0c8e32b60c0ee4d1802f40c962f655bc014a3df95022946c6ecc58b4ab4c\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.165Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e","error":"authconfigs.authorino.kuadrant.io \"ea2c4090bd8996a088a633a490f76548cc1701c7c28498551807d86c75bcaf6e\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.219Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128","error":"authconfigs.authorino.kuadrant.io \"92519187263df94cf84b15259ddeeebb71ac1a80e14c48eadb7168a9d0084128\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.274Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa","error":"authconfigs.authorino.kuadrant.io \"34dc99d6c3d732384daaa44fce10d1fc116a03a68dfe55a8e0d937a494ff5daa\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.329Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74","error":"authconfigs.authorino.kuadrant.io \"647c50e2b4d6322d2cb1051b9349184a786d9725b0a9d71fa7836a7d168c3c74\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.383Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8","error":"authconfigs.authorino.kuadrant.io \"3926972996fcc4d7f8effcea1e53b7d0809d44bec3be6417a5b2555a580eb2f8\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.441Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6","error":"authconfigs.authorino.kuadrant.io \"ab05996cb49a6b16add84fe3f067bed492d2df94090bc34b34f3eab436f0c4a6\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.500Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166","error":"authconfigs.authorino.kuadrant.io \"5c68b61a5f55e79a972b87e51bc2c069211b9ea157517921bc393d353e124166\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.554Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6","error":"authconfigs.authorino.kuadrant.io \"ed85cc1b25a9d4cb05fddd77ef1eeacc1c81a1b50eb9ad939bd7d0d66a0480a6\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.609Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971","error":"authconfigs.authorino.kuadrant.io \"c45321d372f61ea86bf530696979a5c653f431c98ee26de3ae2eb727095ac971\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.663Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab","error":"authconfigs.authorino.kuadrant.io \"f57cdc2dda2fa66c971db6d5db3fa9a3973092e099982c02ea637b276a7731ab\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.718Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef","error":"authconfigs.authorino.kuadrant.io \"967719619b2852bef1a27d9c0a802f8bf31269946d82ee6826de72919a07c8ef\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.778Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1","error":"authconfigs.authorino.kuadrant.io \"73075913121a793e78ed756813233058c9042e5145eb33bac6b25c81a2b9c4c1\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.835Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90","error":"authconfigs.authorino.kuadrant.io \"a382cdaf740b26aa7cdcfb34a596098b3acb2293631999c5aae958b4a4e89f90\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.889Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e","error":"authconfigs.authorino.kuadrant.io \"411ca06866903a159f272dd53a45db313eab53dc1ff39fa7947df28280d6489e\" not found"}
{"level":"error","ts":"2026-11-04T01:26:23.950Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba","error":"authconfigs.authorino.kuadrant.io \"eed33531f0475c2b7cfb3c1e06e80daa9d6f02eff74fa637a1f7fabd537d10ba\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.004Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f","error":"authconfigs.authorino.kuadrant.io \"e3a2a1504848d9be10a2091ad7b63e860efbc908978fb318a538eed353024b2f\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.059Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54","error":"authconfigs.authorino.kuadrant.io \"52dbfaa071a08f40460d7d6f1512ad8f15b90d20b3cd72ff55d058643db40a54\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.113Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af","error":"authconfigs.authorino.kuadrant.io \"2d438ebb1534626bfcffb1b2a8c584c92edf11f2a1675bfea713f996f391f0af\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.172Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735","error":"authconfigs.authorino.kuadrant.io \"991a6afa5ae98a0c75e574c4a1ddf8b7bcd23445bc6cf9e23b211114df998735\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.228Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e","error":"authconfigs.authorino.kuadrant.io \"b4d67fb918a5af2770685a4a8c67096114ad12c1ba5dee6d5dd295f174f1707e\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.282Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86","error":"authconfigs.authorino.kuadrant.io \"13b5fe1e7522ac594be4ca176729aeff4f046b51528285fb6a8e594899dd4d86\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.337Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47","error":"authconfigs.authorino.kuadrant.io \"10de7c2a4b97c8dcddc9e2fe6b5d5ebbfa8abffadeb6797ad2ab9cfcebf9db47\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.392Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b","error":"authconfigs.authorino.kuadrant.io \"3645def58309772db3d4ad009190cfbc23365692b3fcdba119fabf13823f588b\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.446Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38","error":"authconfigs.authorino.kuadrant.io \"90bdef3b6a3f2290344eaacb9fd72bfdd446d9f49c39139ead0c76602f73ed38\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.500Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676","error":"authconfigs.authorino.kuadrant.io \"5f22f5229e90041b254ccf6d2f8b1adfab75175d6ed4bdf96d9102eb07c12676\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.555Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f","error":"authconfigs.authorino.kuadrant.io \"1474639563382ea2ab2bbd422706a8a7ff62cfa4bfd7cb3c17d6d89203c3823f\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.609Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4","error":"authconfigs.authorino.kuadrant.io \"f5e9446b35e4ba12f2d69ffc6d0a6d10fb57f03e9b6ae0567913e7f3e8b620c4\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.664Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209","error":"authconfigs.authorino.kuadrant.io \"a3194f20c9898bde787837fbafb64d4a8e9ae9d17b5091b974353f06b4757209\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.718Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a","error":"authconfigs.authorino.kuadrant.io \"6483a383bf7b9cc647cf22cd8f4b121bb91b303a2eee4a35e776c01389b4221a\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.774Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee","error":"authconfigs.authorino.kuadrant.io \"d86041654cff005f160fd387af8972896906235f2124607188804d7336910dee\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.829Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492","error":"authconfigs.authorino.kuadrant.io \"d063d427a4e6a6f7ad21a8ad3518bde5f206003877082e957c7f17123641b492\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.885Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c","error":"authconfigs.authorino.kuadrant.io \"05ec7b46f135843b603801ddec65d3574d4212088f0d09ef278b483a6f8d514c\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.939Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e","error":"authconfigs.authorino.kuadrant.io \"0482443ec4a8682e915a80c2a81e1611b77e5f0d66217400c8aa8c4c348b354e\" not found"}
{"level":"error","ts":"2026-11-04T01:26:24.996Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894","error":"authconfigs.authorino.kuadrant.io \"5003b417dc6f9d34b971ee78e0116844faab93fe05439d3a4d4ab98246499894\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.051Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22","error":"authconfigs.authorino.kuadrant.io \"1ba2dbc7f2842b032c9e09b62e729fdd73d77e8096dbe33b2774dcbb87176f22\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.106Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3","error":"authconfigs.authorino.kuadrant.io \"faa6c22aca8f578816f3e8fa24e57717a3c244ca6bb69d481dd6e945cac0e4e3\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.160Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e","error":"authconfigs.authorino.kuadrant.io \"d492a31a0a47d155eb88721b4cd47cead3bbeac6d87b1332abc065c5fc3f014e\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.214Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41","error":"authconfigs.authorino.kuadrant.io \"1eda50a88e372a685fc0983450938cbb544f66cb16a9a9417317dfdecf7bad41\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.269Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50","error":"authconfigs.authorino.kuadrant.io \"96bac8b7d482fffc37bb0de40b304005244ba33620dad0550a7c7c5330d0fb50\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e","error":"authconfigs.authorino.kuadrant.io \"3dbda17bb11b1d20e469bd091253e5cc175573853f9eda1b81e48041eaf0619e\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.377Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3","error":"authconfigs.authorino.kuadrant.io \"b8038719d8c5e879ad433f90c46cf0c4ce88639b55f0e1d6cbebaa9d9ae6e2e3\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.432Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad","error":"authconfigs.authorino.kuadrant.io \"6f180609112623d1ecad4e55168f482d8bb6c7ed4c5742ba675d0316e9f66bad\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.486Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380","error":"authconfigs.authorino.kuadrant.io \"11466fc3968fde0dc6442bd339a7b3ea397ea93427bb341da4a31114c5067380\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7","error":"authconfigs.authorino.kuadrant.io \"130ab5ad2b166c96be15edbb3a0442bc7d2a4c9e34b2ec1575c9ebaaebc5aab7\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.595Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8","error":"authconfigs.authorino.kuadrant.io \"0aca07544e3b80985fcf15805798af3dfd95b6e3a711a6502a7fda25eb1f36b8\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.650Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1","error":"authconfigs.authorino.kuadrant.io \"2dd8a77dbf98dd23b7e43ccf963f5545d8e4f7467c090cae73f512930c3345f1\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.704Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d","error":"authconfigs.authorino.kuadrant.io \"9351a692b8c8489d3b4fd2ec0b813c9475eceb491282b01a80f1b16c9318989d\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.759Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335","error":"authconfigs.authorino.kuadrant.io \"ea00a1be3c8dd2cb49f3ba3ae346567296b428ec6891f9e8dc9e011d9ec0e335\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.813Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d","error":"authconfigs.authorino.kuadrant.io \"e12100aaa3d00249e16019b2341777ac2995d95ae26e049944f673174195d69d\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.868Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273","error":"authconfigs.authorino.kuadrant.io \"5cf85a91fc6d8690658dd32e611804dae5687c32f2c3fda1739e6c8629293273\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.924Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267","error":"authconfigs.authorino.kuadrant.io \"01d44c0b1084086c4170cad88a4ca0d2ba35ec6ba750a7d8c625cd410138b267\" not found"}
{"level":"error","ts":"2026-11-04T01:26:25.979Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5","error":"authconfigs.authorino.kuadrant.io \"114bc5c27a9bb738895f5229ecbc793349c37baff8899e5a21800f42afa3b6b5\" not found"}
{"level":"error","ts":"2026-11-04T01:26:26.034Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190","error":"authconfigs.authorino.kuadrant.io \"8ea2afbf9b2f0b03d428ca038d73d2700fd55800484edcd04522c838ae124190\" not found"}
{"level":"error","ts":"2026-11-04T01:26:26.088Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25","error":"authconfigs.authorino.kuadrant.io \"1bb43b89d2a26e293ecdfd12049fefd855a2bc55ad51e27a5a08aea778404d25\" not found"}
{"level":"error","ts":"2026-11-04T01:26:26.143Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0","error":"authconfigs.authorino.kuadrant.io \"1b3b3878adc290bfeb7ff98a728ce82474d56276c61c4fa6c77358225743cea0\" not found"}
{"level":"error","ts":"2026-11-04T01:26:26.197Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a","error":"authconfigs.authorino.kuadrant.io \"7d89763d2f4192e077749f7df46dde688e4eeaccaaf95747acd313eece07721a\" not found"}
{"level":"error","ts":"2026-11-04T01:26:26.252Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7","error":"authconfigs.authorino.kuadrant.io \"b1b44edeaf18f2ad075e95d319da394dad1f9baf846dfea4f7fa6430df4bc3f7\" not found"}
{"level":"error","ts":"2026-11-04T01:26:26.320Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-e6c59a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w1-e6c59a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:26:26.738Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:26.738Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:26:26.813Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-e6c59a-kserve-route","namespace":"ai-tenant-e2e-shared-a-w1-e6c59a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-e6c59a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:26:31.754Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","HTTPRoute","AuthConfig","EnvoyFilter","Limitador","ConfigMap"],"eventTypes":{"create":12,"delete":108,"update":5}}
{"level":"info","ts":"2026-11-04T01:26:31.879Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:32.033Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:26:32.152Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:26:32.152Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:32.632Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:32.633Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:32.635Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:26:32.640Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:32.640Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:32.646Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:32.699Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:33.628Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:33.628Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:38.546Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador","AuthPolicy"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-04T01:26:38.668Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:38.848Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:26:38.948Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:26:38.948Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:39.438Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:39.440Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:39.440Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:39.453Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:39.454Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:39.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:26:39.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:40.459Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:40.459Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:43.131Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-11-04T01:26:43.202Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:43.429Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:26:43.548Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:26:43.548Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:44.024Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:44.025Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:44.025Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:44.026Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:26:44.026Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:44.027Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:44.989Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:44.989Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:57.537Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-04T01:26:58.553Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:58.555Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:58.555Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:58.555Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:58.558Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:26:58.560Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:26:58.714Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:26:59.958Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:26:59.958Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:04.977Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter","TokenRateLimitPolicy","AuthConfig","AuthPolicy","Limitador","HTTPRoute"],"eventTypes":{"create":12,"update":11}}
{"level":"info","ts":"2026-11-04T01:27:05.100Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:05.332Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:27:05.455Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:27:05.455Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:06.030Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:27:06.035Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:06.039Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:27:06.039Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:06.042Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:27:06.043Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:06.043Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:07.024Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:07.027Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:12.050Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","ConfigMap","AuthPolicy"],"eventTypes":{"update":10}}
{"level":"info","ts":"2026-11-04T01:27:12.174Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:12.540Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:27:12.629Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:27:12.629Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:13.131Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:27:13.132Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:13.136Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:27:13.136Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:13.138Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:13.138Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:13.139Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:27:15.091Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:15.091Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:20.072Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthConfig","AuthPolicy"],"eventTypes":{"update":20}}
{"level":"info","ts":"2026-11-04T01:27:21.037Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:21.037Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:21.034Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:27:22.446Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig"],"eventTypes":{"update":1}}
{"level":"error","ts":"2026-11-04T01:27:23.503Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-e6c59a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w1-e6c59a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:27:37.824Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-04T01:27:38.814Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:27:38.816Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:38.816Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:45.601Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","AuthPolicy"],"eventTypes":{"update":20}}
{"level":"info","ts":"2026-11-04T01:27:46.573Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:27:46.573Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:27:46.571Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:06.976Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap"],"eventTypes":{"create":2,"update":2}}
{"level":"info","ts":"2026-11-04T01:28:07.970Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:07.970Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:07.974Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:28:07.981Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:07.981Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:08.048Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:14.368Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","TokenRateLimitPolicy","HTTPRoute","EnvoyFilter"],"eventTypes":{"update":14}}
{"level":"info","ts":"2026-11-04T01:28:14.491Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:14.819Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:28:15.034Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:28:15.034Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:15.454Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:15.456Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:15.456Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:15.472Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:15.513Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:15.516Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:28:15.516Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:28:16.310Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-e6c59a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w1-e6c59a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:28:16.629Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:16.629Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:21.645Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap","Limitador"],"eventTypes":{"update":9}}
{"level":"info","ts":"2026-11-04T01:28:21.767Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:22.048Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:28:22.128Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:28:22.128Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:22.749Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:22.749Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:22.751Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:28:22.753Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:22.753Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:22.753Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:22.867Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:24.854Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:24.854Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:29.894Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","AuthPolicy","TokenRateLimitPolicy","Limitador","EnvoyFilter"],"eventTypes":{"update":28}}
{"level":"info","ts":"2026-11-04T01:28:30.033Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:30.336Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:28:30.428Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:28:30.428Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:31.025Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:31.029Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:28:31.029Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:31.035Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:31.035Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:31.025Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:31.052Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:32.185Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:32.185Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:34.878Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","AuthPolicy","ConfigMap"],"eventTypes":{"update":9}}
{"level":"info","ts":"2026-11-04T01:28:34.956Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:35.141Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:28:35.246Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:28:35.246Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:35.915Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:35.917Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:35.920Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:28:35.920Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:35.923Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:35.923Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:35.926Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:28:36.806Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-e6c59a","namespace":"ai-tenant-e2e-shared-a-w1-e6c59a","uid":"7ac9120c-9c3c-4652-930a-7d7db5a2bd62","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-e6c59a\" not found"}
{"level":"info","ts":"2026-11-04T01:28:36.986Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:36.986Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:42.057Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"delete":1,"update":2}}
{"level":"info","ts":"2026-11-04T01:28:43.042Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:43.042Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:43.045Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:28:43.047Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:43.047Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:43.160Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:50.562Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","ConfigMap","Limitador","AuthPolicy","HTTPRoute","EnvoyFilter"],"eventTypes":{"update":29}}
{"level":"info","ts":"2026-11-04T01:28:50.684Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:50.956Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:28:51.029Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:28:51.029Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:51.643Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:51.650Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:51.655Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:51.655Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:51.713Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:51.725Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:28:51.783Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:28:51.783Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:52.927Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:52.927Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:58.200Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","TokenRateLimitPolicy","EnvoyFilter","Limitador"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-04T01:28:58.336Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:58.620Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:28:58.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:28:58.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:59.256Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:59.258Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:59.258Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:28:59.269Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:28:59.269Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:28:59.316Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:28:59.379Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:29:00.069Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-7cdb6d","namespace":"ai-tenant-e2e-shared-b-w1-7cdb6d","uid":"45199b05-8622-425c-96fb-8e35e0ed6bbf","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-7cdb6d\" not found"}
{"level":"info","ts":"2026-11-04T01:29:00.309Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:00.309Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:05.578Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","Gateway","ConfigMap","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":2,"update":3}}
{"level":"info","ts":"2026-11-04T01:29:05.712Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:06.151Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:29:06.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:29:06.414Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:06.661Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:06.661Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:06.716Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:29:06.717Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:06.717Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:06.728Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:29:06.773Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:29:06.773Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:08.033Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:08.033Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:13.191Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Limitador","HTTPRoute","TokenRateLimitPolicy","ConfigMap","AuthConfig"],"eventTypes":{"delete":12,"update":6}}
{"level":"info","ts":"2026-11-04T01:29:13.313Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:13.759Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:29:13.862Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:29:13.862Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:14.141Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:14.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:14.144Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:29:14.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:14.148Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:14.163Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:14.232Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:15.159Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:15.160Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:20.219Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-04T01:29:20.342Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:20.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:29:20.631Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:29:20.631Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:21.157Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:21.157Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:21.159Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:29:21.159Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:21.652Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:21.652Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:24.046Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-11-04T01:29:24.174Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:24.349Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:29:24.445Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:29:24.445Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:25.051Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:25.052Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:25.052Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:25.053Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:29:25.053Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:25.054Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:26.004Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:26.004Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:29:26.065Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w1-7cdb6d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w1-7cdb6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:29:30.939Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"delete":1,"update":2}}
{"level":"info","ts":"2026-11-04T01:29:31.826Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:31.829Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:29:31.832Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:31.832Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:31.826Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:31.844Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:31.893Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:33.114Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:33.114Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","reconcileID":"c29f91c0-47d4-4229-b54e-4eb2829003be","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","reconcileID":"c29f91c0-47d4-4229-b54e-4eb2829003be","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-e6c59a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","reconcileID":"fc9cbb9d-2074-409f-96ab-40d65b2c18bc","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w1-e6c59a\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-e6c59a","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w1-e6c59a\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:29:37.966Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","ConfigMap","Limitador","Kuadrant","AuthConfig"],"eventTypes":{"delete":13,"update":9}}
{"level":"info","ts":"2026-11-04T01:29:38.095Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:38.102Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:38.446Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:38.531Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:29:38.725Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:29:38.725Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:38.744Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:29:38.961Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:38.962Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:38.962Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:38.963Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:38.969Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:29:39.016Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:29:39.116Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:29:39.116Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:39.981Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:39.981Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:40.425Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-11-04T01:29:41.233Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:41.235Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:41.235Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:41.245Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:41.245Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:41.247Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:29:41.290Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-shared-a-w1-e6c59a","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-w1-e6c59a\" not found"}
{"level":"error","ts":"2026-11-04T01:29:41.303Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-a-w1-e6c59a","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-w1-e6c59a\" not found"}
{"level":"error","ts":"2026-11-04T01:29:41.304Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8d510d6bf0d02874963a62f4afffe682ebeae86d1b80d2d425407ccc8c330178","error":"authconfigs.authorino.kuadrant.io \"8d510d6bf0d02874963a62f4afffe682ebeae86d1b80d2d425407ccc8c330178\" not found"}
{"level":"error","ts":"2026-11-04T01:29:41.313Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:29:41.313Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:29:41.358Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/49e148bcf8f3bd2320a8439c08fcf37e06f12f8a4f69ec3c353f67550d3c27f0","error":"authconfigs.authorino.kuadrant.io \"49e148bcf8f3bd2320a8439c08fcf37e06f12f8a4f69ec3c353f67550d3c27f0\" not found"}
{"level":"error","ts":"2026-11-04T01:29:41.414Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/69a5c4ae27dc8e859a4559f7ab87a64047c4bfc814feb1cad3797354fa1ec640","error":"authconfigs.authorino.kuadrant.io \"69a5c4ae27dc8e859a4559f7ab87a64047c4bfc814feb1cad3797354fa1ec640\" not found"}
{"level":"error","ts":"2026-11-04T01:29:41.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9adcdbd5184b289f728f65383fd5d52ff78e1bc7d5611b2e6cf173973bdeead9","error":"authconfigs.authorino.kuadrant.io \"9adcdbd5184b289f728f65383fd5d52ff78e1bc7d5611b2e6cf173973bdeead9\" not found"}
{"level":"error","ts":"2026-11-04T01:29:41.523Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/42536036e7512c2feb811866135cccb636f11d9d8e3893b6c36572e31a8f7ae6","error":"authconfigs.authorino.kuadrant.io \"42536036e7512c2feb811866135cccb636f11d9d8e3893b6c36572e31a8f7ae6\" not found"}
{"level":"error","ts":"2026-11-04T01:29:41.578Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/314672513711dee5adf50319e2d21cf21916637b1af195669f8677efcd77cfdf","error":"authconfigs.authorino.kuadrant.io \"314672513711dee5adf50319e2d21cf21916637b1af195669f8677efcd77cfdf\" not found"}
{"level":"error","ts":"2026-11-04T01:29:41.717Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-e6c59a","envoyfilter":"openshift-ingress/kuadrant-e2e-shared-a-w1-e6c59a","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w1-e6c59a\" not found"}
{"level":"error","ts":"2026-11-04T01:29:41.928Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-e6c59a-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-w1-e6c59a-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T01:29:42.221Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:42.221Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:29:42.278Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w1-e6c59a","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w1-e6c59a\" not found"}
{"level":"info","ts":"2026-11-04T01:29:47.135Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","EnvoyFilter","AuthConfig","Gateway","AuthPolicy"],"eventTypes":{"delete":11,"update":2}}
{"level":"info","ts":"2026-11-04T01:29:47.204Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:47.424Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:29:47.613Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:29:47.613Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:47.935Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:47.937Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:47.941Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:29:47.946Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:47.946Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:47.957Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:48.019Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:48.808Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:48.808Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","reconcileID":"aaebf78b-79dd-41f6-b2bf-9dbd9e411b1d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","reconcileID":"aaebf78b-79dd-41f6-b2bf-9dbd9e411b1d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","reconcileID":"cd077517-56fb-4a19-b451-4a3154a74c99","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w1-7cdb6d\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-7cdb6d","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w1-7cdb6d\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:29:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:29:53.446Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Kuadrant","Gateway","Limitador","TokenRateLimitPolicy"],"eventTypes":{"delete":1,"update":4}}
{"level":"info","ts":"2026-11-04T01:29:53.528Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:53.549Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:53.731Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:53.834Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:29:53.945Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:29:53.945Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:53.946Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:29:54.324Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:54.325Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:54.325Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:54.339Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:54.339Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:54.342Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-04T01:29:54.400Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:29:54.400Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:55.162Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:55.162Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:55.559Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute"],"eventTypes":{"delete":1}}
{"level":"info","ts":"2026-11-04T01:29:56.145Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:56.145Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:29:56.160Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:56.164Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:29:56.143Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:29:56.225Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:29:56.227Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-shared-b-w1-7cdb6d","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w1-7cdb6d\" not found"}
{"level":"error","ts":"2026-11-04T01:29:56.227Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-b-w1-7cdb6d","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w1-7cdb6d\" not found"}
{"level":"error","ts":"2026-11-04T01:29:56.227Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:29:56.227Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:29:56.281Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9aa0f07f856dd568892afee09d3c5a80e17f53ef1f9f7d8644b82571e5748e34","error":"authconfigs.authorino.kuadrant.io \"9aa0f07f856dd568892afee09d3c5a80e17f53ef1f9f7d8644b82571e5748e34\" not found"}
{"level":"error","ts":"2026-11-04T01:29:56.335Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0e36d6bab9c069523c0854485e3f3c0e4db133628bae2dc86d6838b18045d8f1","error":"authconfigs.authorino.kuadrant.io \"0e36d6bab9c069523c0854485e3f3c0e4db133628bae2dc86d6838b18045d8f1\" not found"}
{"level":"error","ts":"2026-11-04T01:29:56.390Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7c54d5cd94dade158da8cda633e11e361f676982b0597038bfeeac096ce9bbd4","error":"authconfigs.authorino.kuadrant.io \"7c54d5cd94dade158da8cda633e11e361f676982b0597038bfeeac096ce9bbd4\" not found"}
{"level":"error","ts":"2026-11-04T01:29:56.435Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w1-7cdb6d","envoyfilter":"openshift-ingress/kuadrant-e2e-shared-b-w1-7cdb6d","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w1-7cdb6d\" not found"}
{"level":"error","ts":"2026-11-04T01:29:56.444Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d47f056a6a57c4aab2d3e103deea4b8b8ca1c3745491d82642ac31716cf44469","error":"authconfigs.authorino.kuadrant.io \"d47f056a6a57c4aab2d3e103deea4b8b8ca1c3745491d82642ac31716cf44469\" not found"}
{"level":"error","ts":"2026-11-04T01:29:56.498Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1cf602c28d26ed0ede25b9003dbd65913c8a344693d2d34bc508f1d39d5a7d77","error":"authconfigs.authorino.kuadrant.io \"1cf602c28d26ed0ede25b9003dbd65913c8a344693d2d34bc508f1d39d5a7d77\" not found"}
{"level":"error","ts":"2026-11-04T01:29:56.553Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c13e969600dfbc36c16b64b09f5497f16bd2811119ba7cdbc0b846bff64c71b5","error":"authconfigs.authorino.kuadrant.io \"c13e969600dfbc36c16b64b09f5497f16bd2811119ba7cdbc0b846bff64c71b5\" not found"}
{"level":"error","ts":"2026-11-04T01:29:56.852Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w1-7cdb6d-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-b-w1-7cdb6d-maas-auth\" not found"}
{"level":"info","ts":"2026-11-04T01:29:56.989Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:29:56.990Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:01.444Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","AuthPolicy","AuthConfig","EnvoyFilter","TokenRateLimitPolicy","Gateway"],"eventTypes":{"delete":12,"update":2}}
{"level":"info","ts":"2026-11-04T01:30:01.514Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:01.652Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:30:01.738Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:30:01.738Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:02.229Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:02.232Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:30:02.232Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:02.232Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:02.229Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:02.246Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:02.315Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:03.062Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:03.062Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:07.533Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","EnvoyFilter","ConfigMap","Limitador"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-04T01:30:07.655Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:07.744Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:30:07.819Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:30:07.819Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:08.231Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:08.232Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:08.234Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:30:08.234Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:08.236Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:08.236Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:08.246Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:08.885Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:08.886Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:13.189Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","AuthPolicy","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-11-04T01:30:13.309Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:13.442Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:30:13.533Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:30:13.533Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:13.927Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:13.927Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:13.930Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-04T01:30:13.930Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:13.932Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:13.932Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:13.932Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:18.516Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:18.516Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:25.322Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","ConfigMap"],"eventTypes":{"update":56}}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w1-7966af","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-7966af","reconcileID":"8c8dd502-8a0b-4f8e-8eca-5daaae7c2144","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w1-7966af","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-7966af","event":"UPDATE"}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w1-7966af","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-7966af","reconcileID":"8c8dd502-8a0b-4f8e-8eca-5daaae7c2144","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w1-7966af","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-7966af","event":"DELETE"}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w1-7966af\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-04T01:30:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-04T01:30:25.935Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:25.936Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:25.936Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-04T01:30:26.744Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:30:26.988Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"delete":1}}
{"level":"info","ts":"2026-11-04T01:30:27.633Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:27.633Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:27.633Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:27.635Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:30:27.698Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-04T01:30:27.983Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-7966af","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-04T00:11:32Z","generation":15,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"3339de9d-533d-4f55-91d0-b84170f6b978\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-04T01:30:02Z"}],"name":"kuadrant-e2e-worker-w1-7966af","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-7966af","uid":"3339de9d-533d-4f55-91d0-b84170f6b978"}],"resourceVersion":"156390","uid":"84d3cf1b-9529-4eec-8e08-c57c140360fb"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8f671fe7fb5f95b66e479125c8b19fd0217da23efe9684323c945741670436f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"7944c68a19f214e073476795452b68fc9f5c529621681ea36203a49113e60ea4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"44a37e2c7d3d57249bc83945c3dceef1cc1b386a13ea420490c3c498650356fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"55f6b7654a8478c1590ad97fd880538c4663712c8b5f9f65f533de7758a22fa5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6c0eea8cb78db6808b765b480760119a06ee79ae8167f8d90831e4cb281cb055\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4b8eaf23f03d065c5b264b0666f537c2a1f3ae7fc4800d616579730b9f10453e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"fee03f39e20b1fa1cbdef880cfa00e34a91c55cca98dd062d1232a8c504a2a8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"a922303cec22f7f675536511ea62683fd98789b99e59a1c67809c786530aae41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"53857e7b46c67135c4eea145b67cf842f3113bae4858e449b4d0bd56eef71c2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"3ae896f044fa430bcc80634f8b4159dd74a9f5a95c90c59479a5dd22d0c0a777\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2cb7e6e19fbc4c9c857a59ce3a675c11eef097c10a58fd1655b73542355afa67\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"78ffc0a3105eab5a7fae567e63533e82ce53434ea80bc50692e1945291378838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"b9aad3b0a062c993c24c9d12afd48a040a60b2da90cb386f3c22af54c8c885b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"1dc52073af256dbc9bb4be8aaa767206edbfe0aa08db683e79d9c67836f18746\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c08b916a799c7312d7c549cad9123478e41f46f5b311664828e815118232009c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"9ca70c30491e45dd972040fc2132bc2d62a625825b60a0518f18455130575695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0ba6095ced0c22c4974527bf1601e91ad26fdb9633a969255b40ac3b151b5e7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c0b083ec2fc1a3ab9adcf766f5aee6a66960961c41c3c63836a6336fa945104f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"ba4fd17bdedfb57a0c3441c67ea8be06324527464c0ca54e0f7b1e020f9608c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"93832e579686254e6647bbe99864abdbe5a67d9fa759934ac94312f21c416252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"34d332f1eb88b2af92c85c8d2543b4528b4c50eda75d3fb6aee69daef2c453c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"66d98bd56e776500d44f45a0859b97d4562983d2260958e379ea35e9487ad4eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"7d5b6ecac99a81903af1f07695f086c4bfd109bafab8f8194ad4b4fd091b34aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"b2b4d2e55bb399b589ee7e5e2cb4a7f725f020a25a59dc6455aaa53dd45398d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"7d652c0a553e29fb216d2deea09e5c3346e0879578a2d9458153f518172aeb13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c9017f020a8779df1bf1a4aa893cc309f09fc238e8d01959aa19111eb0b5ed65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c6b72d0a40389b38ea00360fdbcf1fb88e393c234225ed00a5a7c17770d9effe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"273f3c97f0d3804192fc0e01200c142ec51c874dee497a0c443d8b979e048ebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a1411cb2ad51a44d8e90c52e56d7f46e474b133b904e181a09843c229568e366\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"3c2eed2c4076ab0ac01618527715b342fa5ecc8d9baa7c79f1feeb964c3799f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f28258d929cf69d90c72cac00d2934012da4e26e93de322cc747cf410dee639\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6849f90c55719b2024e77469af36a9418435813fdba53de85548fc45c8041b2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5fceaf2ba941682d9fd4d19b15e668c594dbfc90f90a5f4b5ab94f14de6719\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4b68355e16dffced958b3c6cf6a85ace82156bf11ac5213f8a94b85b21483dd9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95e5061e7acea19ee7f1646fcc214e8f8f057db8999b6a186708f6a8a194e687\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6e4d91976aaaeb7700bda58ca9f7d4fc8747fc30b47ad671e61c49301d3138c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e4f4c91d80ecb2b9c5e16dc7f16c85265f9b25ba1cdedb41f12bda22dd9a979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0ed28d60417f2be6fd8d8ca4e4f44017f1958dcb5f04c4b83faf3bc6eeab4d6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f475baaea88901f678e1e61313882f0906b83362598efaba02eeb7786e00c4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"bdebda30124b2b8564734f643be613c091aa384bca2e55611ab88e7cd4cd1e3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a31f206ab8dbca0afdfa573363aaccf106a7f54a5ec5ca868f0491263074ecb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"251af245b620a7fa0dd508c8b95ff9e02509b8bbe434073cf9b83ed0bf227633\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"413bdc5e3c8df93edf127de1f068c54db611a5add63e857a73c37db5c6778c81\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2dde942f6b0efa7d7693b097e74d457342dde9cd9f03e35cf7d39070c096b740\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"860dc65fe8df4fdb17f386090ff27961bc6e43ace3152d5a0c9832e5477eef9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"3f40a08f9e67e8dea27e0ac184897b50a4a576eb35780ee92df8400cfcf89d70\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"19f5445fe08773500d55b3e72f93509c2849e7e895c1622c020ddc87da19fffe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"400cdf544c87d2cdde4a5d3684f85f830b61d03ef5e1b02d0be1783c7c45c882\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f540b85497841fd97f6f21f83df47eb33faf6a12440f4d57614189d4bc7e3f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"36893b95343f134093b02742f36ecfccd053fee778fdc4f679be27f0821f963c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ba6e1647cd84f03625de8a02d65d855c5b7014eccd9876502769172d848baf3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"90d439ca579d037200d4b9b1351688c85e60d2b62c325dcd4c864dbca1f9aad0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0c780dabd6df0d31a9112fdc030e2d5ab45c634fa34c405e7c67193ba45c772\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2b0c90ffa9c94815d4d916e763f757d711b83e43dc08707df89db7d8d8406388\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"22d7d611d13f7efc7d2839b9a4d644f15fce375261b2ef9f4c6f4a7c127c986a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"078831a5d217c20da318ae12d6aa231e9bbff23ac0abcd2591db8af03a0f020e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25b24056e5f00ce11ef07850b2b553069f88dfd09550c0f5ef9bd3abd7e8698a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"b093acc088f5b3c6abf3efd2b7e49c62fb4973951ca4bcb2de60b577d838bb0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce534ddc012dd199020559b4cd72e77478d843282db2cc920f6188c0ac48b895\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"fa2a9ebdd28b4100f82ad9bdbf5df9c5aa1c538e9c152619e7c88e18c7d108ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8dba5b80a8bbf465d2b8b22eaabcf3c0bd9ec9943de0ee152b6ff7246eec108\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"2213becdc51c61f7f2e2b6864f2180180274ae136569ddccfa233df684854720\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a2d41d1bfe2845a09f9c006079e27f8bda38d62da8cf25fd8a189dcff49f66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8b5df53b7e5c7e22beb55f83245651dce6a8917bcdf2dd35bc44cc2e3e651fdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbdcc0f989595829fe92a8e9a32d69ea8a40d9b8cf10776562925da6cc33aeb2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"7373120acb8fd2eb2c4957816e801ab94992057655f4e91e779b8aba2001382a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa6b3088cedb629d50bd69ee631bdffecde5a774bb58b1674ffbb601ff8cd135\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4e5201a1a8ee2abf1581a722b9b2764742922db1f0ff711794e338b7f65d0371\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eda9555e5eb3a15f39830032fce44310c889ff832fd0ad45064af7e4bf34363\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"ef25a425e1d6dfe3f23ef10f30a834fe7f3b5ec9eeab376d9f7fedbf161693a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"715838e358b45a42fdfab1383d224600a95382ec941889a2a8cbf028b75f2333\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"f1d83a408601470954b72d92543728a94b837de1f26ba9bcea2689e096a9d18c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486256a75c498ab148cc9bb46bcea251297e2b74e1cf34bad3c55c74a14573c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"99754b4eef34970705761ee0d474fac3c0af931cfc8eeec218184e704566664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b402fefc886c9554b97ff3213c74deae584634017111f44bdedcad110954f5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"cf8a0e7503866d654dd35b207f84dd9afb7d006187b956dd25ac362a1582e4c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdbee3a9bd7f4b5ab291b0c7d51f26f71e9fde499c7da46ea9b0e5cd6486764d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"289d88ae80ca96598acfdb993945a9a7bc9728d40a7752db7cd5dfcc4255cf87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c01a1bbd47226264fe8f94e0d3575ca0ff85f4d02cb4b4ce6550ff37288daa4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"beb7bad3db035dde2975e132668d9e271e70d2a74fb9bf4ea61939150d443fbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75b7df72e9c7be8b9431666359ab3de5e8df05448b1f4b0276e5456fbcbb30a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6ae83b4faccc867bb2b6cd562e04a27a61b810d3207c407f63565cd861a705c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5516d78005de2cfe8956e3ba1e8ec342a541cc4002706d987fcd519d0b67cf71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"dfaf750c9abe122c321117f70e65b282b6e2c59110bb0232a53f861824281705\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4556062116dd6b1b9e44244b886671cebc576038b0f9c1c1fe3e13deefafa523\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"5c9517da623973c54b0e61ed81b97b5019e20a39cee4222e9c2001fdb37f61c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa04b5c8a50845ad82f4ea9bd5f1f7c759ce4450149519bb00523b008482cb75\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6052d33df74209b62973bde64ad856897511f6c7fa48511e4a12fdc24287a50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad466fcf1c5c4d7345f6eb4fa5808cff0469e236def3863eb4783f677353d152\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"effd523d3498f1d53a6191e49c89ec1a161c7bcacb667779c6d8003047645c13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e8588abbd835e92bd8170bc89597b0d56f24271385f73e5fad17ec99a7389718\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"f4b7585e2b62ac0a7dbb3a671941f9be5fe33ba4c89700d7d3d938c179517ab4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08d9d2aa5fadedf5c6dfbc45eb4f9c34ea2a1882947995b5c79a92c618dd8d69\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"182222bc7dc75bc923b9c50cb3480521ab543e3d3f58674f35fa711b4a4fa69b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"061c7e4d1b1d8866722f6c06899571bde9ea56d77ea14ff59cf1d915e2d9b1c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"d755fedb11567ddbb0eb17e40e71678bcdffb7ce224b77d1c35bce75b6f556e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de657ac3c36b9a560af065f79a5ee929b70dec023b7155afc6b66e41a52fb273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"43f437f56d846d068e2783e265d65343acc185d8e9b1b43de9a84d4b8a4bcf25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c39303e83fe285ea577e6e31ef4627d8e9c1575ce9cbf3c5585da04dc9c3146b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c03721f568137f1d8835419637c079a8fab9caa0309f3e0567b19d99133eac2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7eedcaf178c841ed379be213f3f34665f16bbe619f0fe9ef35d71b19c579b94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"aa1b2e83bb519ec79fcb87c4512f8421b5031a1f66602c9fef9caa19a2fecc9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6be017c8c4a655f626b1a60defee892156238e99009d2e530b9cb9de189201a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0f30b14be9585141d957a722c9bee91c27f7cf218fba3d4916cd634fa6b8c5f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e43cec109a35717b74a3a54ae0f1006635a20b91c9de1e75a82c32f0339b4ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"0eb8bee651ce7b42a148f283b008ad1b9eab9530a3234bdeaa371aa9074c6141\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f17d178977a829b7cb25e144281dd8bc17cfea4201e8f9d6e4abd729b51db1b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"15b69076679c9ee18f60045fa3138d011c2d117b2656f00acad6ea10179f5206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ccb310d1f482e6b78361f68b84c67bc46f7ad1c23eca07e13b5c6a27a096cf5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"3006c2eb1cf0340b97d9cf4bdbdd7cea90026fcaf2fdfc3dd08c8e58ceae1938\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3eb001e52c79b1aa88f706bcbfda6899dd3d8312d2217dbb4f6b058a4602615\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"993295647de89316ed5016fc8beea92b6a66a8b34e5282043de690d88ac6d739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aaae91b1f31dbd6654a5fd3c753d7ab2f9a54c9a352837dfd278c60a0fd25213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"411aef1a70bd99e949e340f4bff5dec9eb942d0e06e7075a78d572b412b7a939\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c928bea546bc63b3b8bd5d85d7a8f44207359e9772db70e9d65e9a38a136764\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8be814115fb7da807809a189087e4e033d326542da651f00ae28c8f14a5a6838\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b458934204e7bd220bde8b2123b49c7fa677b901b7dc883fd85cbd8bef09f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"16517301869349c194fdc9624b1d4ecbd0be903f42b8c985af97867cf0023016\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-7966af/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ef3137adb71b08c83f1177afdfd70e3ceb53eb40eee682f1eb18aad1359fc66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8c7fce071dce1e65b18501c98e406d87231372ae5a9f5e8c347b65788df91aff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b13167a0b9b904765e5c7590d0ff54a0d4055061140144c50ac8d78e7f149e30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"8e181d00f8b265fa8906db42847f65f424eec53caedb83469692e55f37e669d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a4b7d2121c1a0b6ea0d6f91f0b6dfca2759729cfe994a2eb6a6667e6b4edd0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"6713bc99135c617edeeaade68698ecdf33d333131a77de2650c51b3b2fb36ef9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5eb305150bdafd8cd17ff8f66d77a2997545fb016d4fc2403dd456d505ca0b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"01277e6b7cec6e52c5ed8c8a780cb7fa31f56958fa93a2a5627034febf8791e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ec9fcf7e18d4cac0d461636f2eca5067beeaa5440b72ee39b4f1cde5931fe481\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-7966af\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"41c187b864990629cecc9d75d09c283380fe5f99f4b35a1ec1a6932fb112a785\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9d90b0ca5be53b16d790c3082127cc7315e4666ae929559754734de0429c8be\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/simulator-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"4b58c3803487d40cd3d7d9dc63790243a7353b4a1f8b9fd9ae2c009fc55d5d8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/simulator-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"26e65caa35770dcea82c3bc46eb21156e68b0f237e536d0654e8b461fea79765\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/premium-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"443894938bd03a0c0dfb1a13d4e30954bc3b4aef05764e52dc4647fddd6751e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/premium-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48a8bde041ff87e0d7ca43c9b2cb552d0278f317b6db01967ac7e2b21386b4bd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"c1e45b5496eca64cf0b773c04ff151ed5a4c0fb5e66b08193d6941fdb5aeadbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-w1-7966af')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1945604402dab22a2bb92e179c6db3181c9764e9e4b91fc7ed2f36d11c05b72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-7966af-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__24300a3e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-7966af/distinct-2-w1-7966af-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-7966af\"]}],\"name\":\"d2cbb037fb718698317e136295b45ed06d5851b3e4dd7b69cc5d4284cfa0e31b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-7966af/models/e2e/distinct-2-w1-7966af')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-7966af"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:30:28.289Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w1-7966af","namespace":"openshift-ingress","uid":"a1cbb6c9-bde5-41c7-8af5-c93b9addf267","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w1-7966af\" not found"}
{"level":"error","ts":"2026-11-04T01:30:28.440Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w1-7966af-kserve-route","namespace":"e2e-models-e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-w1-7966af-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-04T01:30:28.476Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:30:33.030Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","EnvoyFilter","AuthPolicy","Kuadrant","HTTPRoute","Gateway","Limitador"],"eventTypes":{"delete":2,"update":9}}
{"level":"info","ts":"2026-11-04T01:30:33.151Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:33.164Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:33.262Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:30:33.335Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:33.432Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:30:33.432Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:33.433Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:30:33.840Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:33.841Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:33.841Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:33.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:33.855Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:30:33.856Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-04T01:30:33.913Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:30:33.913Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:34.462Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:34.462Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:39.254Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","EnvoyFilter","HTTPRoute","Limitador","Gateway","AuthConfig"],"eventTypes":{"delete":7,"update":8}}
{"level":"info","ts":"2026-11-04T01:30:39.406Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:39.563Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-04T01:30:39.665Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-04T01:30:39.665Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:40.075Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:40.076Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:40.076Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:40.114Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-04T01:30:40.115Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:40.118Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-04T01:30:40.182Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-04T01:30:40.722Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:40.722Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-04T01:30:40.974Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-7966af","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w1-7966af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-04T01:30:47.227Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"delete":4,"update":3}}
{"level":"info","ts":"2026-11-04T01:30:47.295Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-04T01:30:47.321Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}